Blank Slate Campaign Pushes Cerber Ransomware

Criminals are breathing new life into Cerber ransomware with a stubborn spam campaign called Blank Slate that is successfully abusing hosting providers to spread the malware. Researchers at the SANS Internet Storm Center said the campaign has shifted from spreading Sage 2.0 and Locky ransomware, ...

Wireless IP Camera (P2P) WIFICAM Pre-Authorized Information and Credentials Leakage Vulnerability

Wireless IP Camera P2P WIFICAM is a wireless IP camera. Wireless IP Camera P2P WIFICAM pre-authorization information and credential leakage vulnerability. By providing blank "loginuse" and "loginpas" parameters when accessing the server configuration file, an attacker can bypass the device's...

WS-2017-3789

In “TEAMMATES/teammates”, versions prior to v5.93 mishandles target=blank in A elements, which makes it easier for remote attackers to conduct redirection attacks...

Microsoft Edge Remote Elevation of Privilege Vulnerability

Microsoft Edge is the web browser built into the Windows 10 version. Microsoft Edge has an elevation of privilege vulnerability in the about:blank page cross-domain policy implementation that allows an attacker to access information in one domain and insert it into other domains. An attacker who...

CVE-2016-2349

Remedy AR System Server in BMC Remedy 8.1 SP 2, 9.0, 9.0 SP 1, and 9.1 allows attackers to reset arbitrary passwords via a blank previous password...

VulnCheck KEV: CVE-1999-0502

A Unix account has a default, null, blank, or missing password...

Arbitrary File Deletion Vulnerability in 'hid_name' in OfficeTen Management System of NetEconomic Technology (Suzhou) Co.

OfficeTen is an enterprise next-generation converged communication product that integrates voice, data, security, and real-time communication applications, developed by Nethru Technology with independent innovation and its own intellectual property rights. Arbitrary file deletion vulnerability...

Hardcoded credentials

Open Dental 16.1 and earlier has a hardcoded MySQL root password, which allows remote attackers to obtain administrative access by leveraging access to intranet TCP port 3306. NOTE: the vendor disputes this issue, stating that the "vulnerability note ... is factually false ... there is indeed a...

Moxa MiiNePort Blank Default Telnet Password

The remote device has a telnet service protected by blank default credentials that allow privileged access to the device. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if description scriptid93527; scriptversion"1.10";...

CVE-2016-5149

The extensions subsystem in Google Chrome before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux relies on an IFRAME source URL to identify an associated extension, which allows remote attackers to conduct extension-bindings injection attacks by leveraging script access to a...

UBUNTU-CVE-2016-5149

The extensions subsystem in Google Chrome before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux relies on an IFRAME source URL to identify an associated extension, which allows remote attackers to conduct extension-bindings injection attacks by leveraging script access to a...

Google Chrome URL Forgery Vulnerability

Google Chrome is a web browser developed by the American company Google Google. A URL forgery vulnerability exists in the file ios/web/webstate/ui/crwwebcontroller.mm in versions of Google Chrome prior to 52.0.2743.82 on the iOS platform, which stems from a failure to verify that invalid URLs are...

CVE-2016-1707

ios/web/webstate/ui/crwwebcontroller.mm in Google Chrome before 52.0.2743.82 on iOS does not ensure that an invalid URL is replaced with the about:blank URL, which allows remote attackers to spoof the URL display via a crafted web site...

Juniper Junos SRX Series Upgrade Handling Local Root Authentication Bypass (JSA10753)

According to its self-reported version number, the remote Juniper Junos device is affected by a security bypass vulnerability due to a flaw that is triggered when using the partition option during an upgrade. A local attacker can exploit this to bypass authentication checks and access the root...

CVE-2016-2286

Moxa MiiNePortE14641 devices with firmware 1.1.10 Build 09120714, MiiNePortE17080 devices with firmware 1.1.10 Build 09120714, MiiNePortE21242 devices with firmware 1.1 Build 10080614, MiiNePortE24561 devices with firmware 1.1 Build 10080614, and MiiNePort E3 devices with firmware 1.0 Build...

CVE-2016-2286

Moxa MiiNePortE14641 devices with firmware 1.1.10 Build 09120714, MiiNePortE17080 devices with firmware 1.1.10 Build 09120714, MiiNePortE21242 devices with firmware 1.1 Build 10080614, MiiNePortE24561 devices with firmware 1.1 Build 10080614, and MiiNePort E3 devices with firmware 1.0 Build...

CVE-2016-2286

Moxa MiiNePortE14641 devices with firmware 1.1.10 Build 09120714, MiiNePortE17080 devices with firmware 1.1.10 Build 09120714, MiiNePortE21242 devices with firmware 1.1 Build 10080614, MiiNePortE24561 devices with firmware 1.1 Build 10080614, and MiiNePort E3 devices with firmware 1.0 Build...

CVE-2016-2286: Improper Authentication

Moxa MiiNePortE14641 devices with firmware 1.1.10 Build 09120714, MiiNePortE17080 devices with firmware 1.1.10 Build 09120714, MiiNePortE21242 devices with firmware 1.1 Build 10080614, MiiNePortE24561 devices with firmware 1.1 Build 10080614, and MiiNePort E3 devices with firmware 1.0 Build...

PT-2016-5089

Name of the Vulnerable Software and Affected Versions Moxa MiiNePort E1 4641 version 1.1.10 Build 09120714 Moxa MiiNePort E1 7080 version 1.1.10 Build 09120714 Moxa MiiNePort E2 1242 version 1.1 Build 10080614 Moxa MiiNePort E2 4561 version 1.1 Build 10080614 Moxa MiiNePort E3 version 1.0 Build...

CVE-2016-1657

The WebContentsImpl::FocusLocationBarByDefault function in content/browser/webcontents/webcontentsimpl.cc in Google Chrome before 50.0.2661.75 mishandles focus for certain about:blank pages, which allows remote attackers to spoof the address bar via a crafted URL...