CVE-2018-10355

CVE-2018-10355 affects Trend Micro Email Encryption Gateway (TMEEG) version 5.5. The vulnerability resides in the DBCrypto class, which stores user passwords using a hard-coded key in a recoverable format. An attacker who gains access to the target’s user database can exploit the flaw to recover ...

Trend Micro Encryption for Email Gateway DBCrypto Authentication Weakness Vulnerability

This vulnerability allows attackers to recover user passwords on vulnerable installations of Trend Micro Encryption for Email Gateway. An attacker must first obtain access to the user database on the target system in order to exploit this vulnerability. The specific flaw exists within the DBCrypt...

The vulnerability of the LDAP server in the Samba networking software package allows a hacker to alter the passwords of other users.

The vulnerability of the LDAP server of the Samba networking software, which is configured as an Active Directory domain controller, is related to deficiencies in the authentication mechanism. Exploiting this vulnerability allows a malicious actor to remotely change the passwords of other users...

The vulnerability of Phoenix Contact FL SWITCH router microprogramming software, related to deficiencies in authentication procedures, allows a malicious actor to gain access to the device with administrator privileges.

The vulnerability of Phoenix Contact FL SWITCH router microprogramming software is related to deficiencies in the authentication process. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain administrator privileges through specially crafted HTTP requests...

The vulnerability of Phoenix Contact FL SWITCH router microprogramming software, related to deficiencies in authentication procedures, allows a intruder to access diagnostic information.

The vulnerability of Phoenix Contact FL SWITCH router microprogramming software is related to deficiencies in the authentication process. Exploiting this vulnerability allows a malicious actor to remotely access diagnostic information by using the device’s monitoring mode...

The vulnerability of Brother printer’s microprogramming software, related to deficiencies in authentication procedures, allows attackers to gain access to the devices.

The vulnerability of Brother’s microprogramming software is related to deficiencies in the authentication process. After a failed attempt to access the HTTP response, the valid AuthCookie is retained. Exploiting this vulnerability could allow a malicious actor to gain access to the device remotel...

The vulnerability of the PostgreSQL database management system, related to deficiencies in the authentication process, allows attackers to gain access to the database account.

The vulnerability of the PostgreSQL database management system is related to deficiencies in the authentication process. Exploiting this vulnerability allows a malicious actor to gain access to the database account with an empty password...

PYSEC-2017-66

The checkPassword function in python-kerberos does not authenticate the KDC it attempts to communicate with, which allows remote attackers to cause a denial of service bad response, or have other unspecified impact by performing a man-in-the-middle attack...

Trend Micro Threat Discovery Appliance <= 2.6.1062r1 log_query_dlp.cgi Command Injection Remote Code Execution Vulnerability (CVE-2016-8590)

Summary: There exists a post authenticated command injection vulnerability that can be used to execute arbitrary code as root. Notes: - Since this is a busybox, getting a connectback seemed hard. So, for this particular PoC, all I did was exec a bind shell using netcat. - Auth is VERY weak, no...

The vulnerability of the McAfee VirusScan Enterprise anti-virus software allows a hacker to trigger a service failure or execute arbitrary code.

The vulnerability of the McAfee VirusScan Enterprise antivirus software is related to deficiencies in its authentication process. Exploiting this vulnerability allows a malicious actor to execute arbitrary code or cause service interruptions remotely...

CVE-2016-6825

Huawei XH620 V3, XH622 V3, and XH628 V3 servers with software before V100R003C00SPC610, RH1288 V3 servers with software before V100R003C00SPC613, RH2288 V3 servers with software before V100R003C00SPC617, and RH2288H V3 servers with software before V100R003C00SPC515 allow remote attackers to obtai...

Teaching content management system ATutor 2.2.1 injection vulnerability-vulnerability warning-the black bar safety net

Atutor is an open source“content management system”Learning Content Management System, referred to as LCMS。 Using PHP, MySQL, HTTP Web server is recommended to use Apache. Teaching content management system ATutor 2.2.1 injection vulnerability Atutor in addition to teaching content management...

ATutor 2.2.1 SQL Injection / Remote Code Execution

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 'ATutor 2.2.1 SQL Injection / Remote Code Execution', 'Description' = %q This module exploits a SQL Injection vulnerability and an...

ATutor 2.2.1 - SQL Injection / Remote Code Execution (Metasploit)

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 'ATutor 2.2.1 SQL Injection / Remote Code Execution', 'Description' = %q This module exploits a SQL Injection vulnerability and an...

ATutor 2.2.1 SQL Injection / Remote Code Execution

This module exploits a SQL Injection vulnerability and an authentication weakness vulnerability in ATutor. This essentially means an attacker can bypass authentication and reach the administrator's interface where they can upload malicious code. This module requires Metasploit:...

The vulnerability of the microprogramming software of the Cisco wireless LAN controller allows a intruder to alter configuration parameters.

The vulnerability of Cisco wireless LAN controllers’ microprogramming software is related to deficiencies in authentication procedures. Exploiting this vulnerability could allow a malicious actor to remotely alter configuration parameters...

PT-2015-2867

Name of the Vulnerable Software and Affected Versions Juniper ScreenOS versions 6.2.0r15 through 6.2.0r18 Juniper ScreenOS versions 6.3.0r12 before 6.3.0r12b Juniper ScreenOS versions 6.3.0r13 before 6.3.0r13b Juniper ScreenOS versions 6.3.0r14 before 6.3.0r14b Juniper ScreenOS versions 6.3.0r15...

The vulnerability of the microprogramming software in Janitza UMG 508, 509, 511, 604, 605 power supply monitoring systems allows a intruder to gain access to the device.

The vulnerability of the web interface of the Microprogramming Software for Control Systems of Power Supply Devices Janitza UMG 508, 509, 511, 604, 605 arises from the fact that these devices only support short PIN codes for authentication. Exploiting this vulnerability could allow an attacker,...

The vulnerability of the microprogramming software of Schneider Electric’s Modicon M340 programmable logic controller allows a intruder to trigger a service failure or execute arbitrary code.

The vulnerability of the microprogrammed software of Schneider Electric’s Modicon M340 programmable logic controller is due to authentication deficiencies. Exploiting this vulnerability could allow an attacker to cause malfunctions in service operations or execute arbitrary codes...

The vulnerability of the Cisco IOS operating system, which allows a perpetrator to gain unauthorized access to the device

The vulnerability of the SSHv2 component in Cisco IOS systems is related to deficiencies in the authentication process. Exploiting this vulnerability allows a malicious actor to gain unauthorized access to a device by manipulating information about known user names and their associated RSA keys...