Default credentials

PhotoRange Photo Vault 1.2 appends the password to the URI for authorization, which makes it easier for remote attackers to bypass intended GET restrictions via a brute-force approach, as demonstrated by "GET /login.htmlpasswd1" and "GET /login.htmlpasswd2" and so on...

CVE-2018-20371

PhotoRange Photo Vault 1.2 appends the password to the URI for authorization, which makes it easier for remote attackers to bypass intended GET restrictions via a brute-force approach, as demonstrated by "GET /login.htmlpasswd1" and "GET /login.htmlpasswd2" and so on...

CVE-2018-20371

CVE-2018-20371 affects PhotoRange Photo Vault 1.2. The issue is failure to securely handle authentication by appending the password to the URI, enabling brute-force like access to GET-restricted pages (e.g., /login.html__passwd1, /login.html__passwd2). Multiple records (NVD, Red Hat advisory, CVE...

CVE-2018-20371

PhotoRange Photo Vault 1.2 appends the password to the URI for authorization, which makes it easier for remote attackers to bypass intended GET restrictions via a brute-force approach, as demonstrated by "GET /login.htmlpasswd1" and "GET /login.htmlpasswd2" and so on...

PT-2018-15327

Name of the Vulnerable Software and Affected Versions PhotoRange Photo Vault version 1.2 Description The issue allows remote attackers to bypass intended GET restrictions via a brute-force approach. This is because the password is appended to the URI for authorization. For example, attackers can...

CVE-2018-20371: Exposure of Sensitive Information to an Unauthorized Actor

PhotoRange Photo Vault 1.2 appends the password to the URI for authorization, which makes it easier for remote attackers to bypass intended GET restrictions via a brute-force approach, as demonstrated by "GET /login.htmlpasswd1" and "GET /login.htmlpasswd2" and so on...

F5 Networks BIG-IP : BIG-IP SNMP vulnerability (K42027747)

The version of F5 Networks BIG-IP installed on the remote host is prior to 14.1.0. It is, therefore, affected by a vulnerability as referenced in the K42027747 advisory. The passphrases for SNMPv3 users and trap destinations that are used forauthentication and privacy are not handled by the BIG-I...

CVE-2018-15328

On BIG-IP 14.0.x, 13.x, 12.x, and 11.x, Enterprise Manager 3.1.1, BIG-IQ 6.x, 5.x, and 4.x, and iWorkflow 2.x, the passphrases for SNMPv3 users and trap destinations that are used for authentication and privacy are not handled by the BIG-IP system Secure Vault feature; they are written in the cle...

CVE-2018-15328

On BIG-IP 14.0.x, 13.x, 12.x, and 11.x, Enterprise Manager 3.1.1, BIG-IQ 6.x, 5.x, and 4.x, and iWorkflow 2.x, the passphrases for SNMPv3 users and trap destinations that are used for authentication and privacy are not handled by the BIG-IP system Secure Vault feature; they are written in the cle...

CVE-2018-19786

HashiCorp Vault before 1.0.0 writes the master key to the server log in certain unusual or misconfigured scenarios in which incorrect data comes from the autoseal mechanism without an error being reported...

Design/Logic Flaw

HashiCorp Vault before 1.0.0 writes the master key to the server log in certain unusual or misconfigured scenarios in which incorrect data comes from the autoseal mechanism without an error being reported...

CVE-2018-19786

HashiCorp Vault before 1.0.0 writes the master key to the server log in certain unusual or misconfigured scenarios in which incorrect data comes from the autoseal mechanism without an error being reported...

CVE-2018-19786

HashiCorp Vault before 1.0.0 writes the master key to the server log in certain unusual or misconfigured scenarios in which incorrect data comes from the autoseal mechanism without an error being reported...

CVE-2018-19786

HashiCorp Vault before 1.0.0 writes the master key to the server log in certain unusual or misconfigured scenarios in which incorrect data comes from the autoseal mechanism without an error being reported...

CVE-2018-19786

HashiCorp Vault before 1.0.0 can write the master key to the server log in certain misconfigured autoseal scenarios without reporting an error. Affected component: Vault autoseal flow; root cause is improper handling of autoseal data. Impact: potential exposure of the master key via logs, enablin...

PT-2018-15092

Name of the Vulnerable Software and Affected Versions HashiCorp Vault versions prior to 1.0.0 Description The issue arises in certain unusual or misconfigured scenarios where incorrect data comes from the autoseal mechanism without an error being reported, causing the master key to be written to...

CVE-2018-19786: Insertion of Sensitive Information into Log File

HashiCorp Vault before 1.0.0 writes the master key to the server log in certain unusual or misconfigured scenarios in which incorrect data comes from the autoseal mechanism without an error being reported...

Accused CIA Leaker Faces New Charges of Leaking Information From Prison

Joshua Adam Schulte , a 30-year-old former CIA computer programmer who was indicted over four months ago for masterminding the largest leak of classified information in the agency's history, has now been issued three new charges. The news comes just hours after Schulte wrote a letter to the feder...

RHEL 6 / 7 : Red Hat JBoss Web Server 5.0 Service Pack 1 (RHSA-2018:2868)

The remote Redhat Enterprise Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:2868 advisory. Red Hat JBoss Web Server is a fully integrated and certified set of components for hosting Java web applications. It is comprised of the...

Important: Red Hat Security Advisory: Red Hat JBoss Web Server 5.0 Service Pack 1 security and bug fix update

An update is now available for Red Hat JBoss Web Server 5.0 for RHEL 6 and Red Hat JBoss Web Server 5.0 for RHEL 7. Red Hat Product Security has rated this release as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity...