Hey, Music Lovers! Last.Fm Hack Leaks 43 Million Account Passwords

Another Day, Another Data Breach! If you love to listen to music online and have an account on Last.fm website, your account details may have compromised in a data breach that leaked more than 43 Million user personal data online. Last.fm was hacked in March of 2012 and three months after the...

ZKTeco ZKBioSecurity 3.0 User Enumeration

!/usr/bin/env python ZKTeco ZKBioSecurity 3.0 User Enumeration Weakness Vendor: ZKTeco Inc. | Xiamen ZKTeco Biometric Identification Technology Co.,ltd Product web page: http://www.zkteco.com Affected version: 3.0.1.0R230 Platform: 3.0.1.0R230 Personnel: 1.0.1.0R1916 Access: 6.0.1.0R1757 Elevator...

OpenSSH 7.x < 7.3 Multiple Vulnerabilities

Binary data 9507.prm...

Microsoft Universal Outlook Information Disclosure Vulnerability

Microsoft Windows is the popular computer operating system. Universal Outlook is vulnerable to an information disclosure vulnerability if the establishment of a secure connection fails. An attacker could exploit this vulnerability to obtain username and password information...

Universal Outlook Information Disclosure Vulnerability

An information disclosure vulnerability exists when Universal Outlook fails to establish a secure connection. An attacker could use this vulnerability to obtain the username and password of a user. The update addresses the vulnerability by preventing Universal Outlook from disclosing usernames an...

Suspicious Image Attachment In Phishing Mail

Mail messages containing suspicious image file attachments were observed as part of various phishing campaigns. An attacker may use such phishing messages to entice users to disclose sensitive information such as usernames, passwords, and credit card details...

ntop-ng 2.5.160805 - Username Enumeration

Exploit title: ntopng user enumeration Author: Dolev Farhi Contact: dolevf at protonmail.com Date: 04-08-2016 Vendor homepage: ntop.org Software version: v.2.5.160805 !/usr/env/python import os import sys import urllib import urllib2 import cookielib server = 'ip.add.re.ss' username = 'ntopng-use...

The vulnerability of the Windows operating system, which allows a malicious individual to intercept confidential information

Data related to Telnet protocol in the Windows operating system is transmitted in an unencrypted form. This allows a remote malicious individual to intercept confidential information, including user names and passwords, by analyzing network traffic...

Keybase: Register multiple users using one invitation (race condition)

Hi, It is possible to create multiple accounts using a single invitationid due to a race condition bug in //api/1.0/signup.json. I have successfully created 8 accounts using invitation with id = 37c5a121adf23e90b875500d The account usernames: novijosiptest1,2,4,5,6,8,9,10 you can delete them, I...

LizardStresser IoT Botnets Part of 400Gbps DDoS Attacks

LizardStresser, a distributed denial of service botnet, has found new life leveraging hundreds of internet-based webcams in attacks against Brazilian-based banks, government agencies as well as a handful of U.S.-based gaming companies. Researchers at the Arbor’s Security Engineering and Response...

Authentication flaw

The attemptAuthentication function in Component/Security/Http/Firewall/UsernamePasswordFormAuthenticationListener.php in Symfony before 2.3.41, 2.7.x before 2.7.13, 2.8.x before 2.8.6, and 3.0.x before 3.0.6 does not limit the length of a username stored in a session, which allows remote attacker...

UBUNTU-CVE-2016-4423

The attemptAuthentication function in Component/Security/Http/Firewall/UsernamePasswordFormAuthenticationListener.php in Symfony before 2.3.41, 2.7.x before 2.7.13, 2.8.x before 2.8.6, and 3.0.x before 3.0.6 does not limit the length of a username stored in a session, which allows remote attacker...

CVE-2016-4423

The attemptAuthentication function in Component/Security/Http/Firewall/UsernamePasswordFormAuthenticationListener.php in Symfony before 2.3.41, 2.7.x before 2.7.13, 2.8.x before 2.8.6, and 3.0.x before 3.0.6 does not limit the length of a username stored in a session, which allows remote attacker...

Debian DSA-3588-1 : symfony - security update

Two vulnerabilities were discovered in Symfony, a PHP framework. - CVE-2016-1902 Lander Brandt discovered that the class SecureRandom might generate weak random numbers for cryptographic use under certain settings. If the functions randombytes or opensslrandompseudobytes are not available, the...

Sensio Labs Symfony Denial of Service Vulnerability

Sensio Labs Symfony is a free French Sensio Labs company , based on the MVC architecture of the PHP development framework . The framework provides commonly used functional components and tools , can be used to quickly create complex WEB program . A security vulnerability exists in Sensio Labs...

Debian Security Advisory DSA 3588-1 (symfony - security update)

Two vulnerabilities were discovered in Symfony, a PHP framework. CVE-2016-1902 Lander Brandt discovered that the class SecureRandom might generate weak random numbers for cryptographic use under certain settings. If the functions randombytes or opensslrandompseudobytes are not available, the outp...

XenAPI For XenForo 1.4.1 SQL Injection

RCE Security Advisory https://www.rcesecurity.com 1. ADVISORY INFORMATION ======================= Product: XenAPI for XenForo Vendor URL: github.com/Contex/XenAPI Type: SQL Injection CWE-89 Date found: 2016-05-20 Date published: 2016-05-23 CVSSv3 Score: 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVE...

TH692 Outdoor P2P HD Waterproof IP Camera Hard-Coded Credentials

Exploit Title: TH692- Outdoor P2P HD Waterproof IP Camera hardcoded credentials Date: 4/16/2016 Exploit Author: DLY Vendor: TENVIS Technology Co., Ltd Product: TH692- Outdoor P2P HD Waterproof IP Camera Product webpage: http://www.tenvis.com/th-692-outdoor-p2p-hd-waterproof-ip-camera-p-230.html...

Cerberus Helpdesk User Hash Disclosure

This module extracts usernames and password hashes from the Cerberus Helpdesk through an unauthenticated access to a workers file. Verified on Version 4.2.3 Stable Build 925 and 5.4.4 Module Options msf use auxiliary/gather/cerberus/helpdeskhashdisclosure msf undefinedhelpdeskhashdisclosure show...

CVE-2016-0864

Tollgrade SmartGrid LightHouse Sensor Management System SMS Software EMS before 5.1, and 4.1.0 Build 16, allows remote attackers to obtain sensitive report and username information via unspecified vectors...