Pagelime CMS XSS / Credential Disclosure

================================================================================================================================================= PAGELIME CMS jQuery Cross Site Scripting / Unencrypted VIEWSTATE parameter / User credentials are sent in clear text / Login page password-guessing...

[WiFi Password Dump] Command-line Tool to Recover Wireless Passwords

WiFi Password Dump is the free command-line tool to quickly recover all the Wireless account passwords stored on your system. It automatically recovers all type of Wireless Keys/Passwords WEP/WPA/WPA2 etc stored by Windows Wireless Configuration Manager. For each recovered WiFi account, it displa...

Ebuddy Web Messenger Disclosure / CSRF Vulnerabilities

Ebuddy Web Messenger suffers from index disclosure, cross site request forgery, htaccess file disclosure, and insecure credential transport vulnerabilities...

PuTTY Information Disclosure Vulnerability - Windows

PuTTY is prone to an information disclosure vulnerability. SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:putty:putty"; if...

CVE-2013-4038

The Intelligent Platform Management Interface IPMI implementation in Integrated Management Module IMM on IBM BladeCenter, Flex System, System x iDataPlex, and System x3 servers uses cleartext for password storage, which allows context-dependent attackers to obtain sensitive information by reading...

ZZN SQL Injection / XSS / Credential Disclosure

ZZN Web Hosting and Free email accounts Blind SQLInjection / Cross Site Scripting /User credentials are sent in clear text/ ================================================================================================================================================== Report-Timeline:...

Western Digital My Net Devices Information Disclosure Vulnerability

Western Digital My Net Router is prone to an information disclosure vulnerability. SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescriptio...

Western Digital My Net Wireless Routers - Password Disclosure

Western Digital My Net Wireless Routers - Password Disclosure Vulnerable Systems: Western Digital My Net Series Wireless Routers: N600 Firmware 1.03.12 N600 Firmware 1.04.16 N750 Firmware 1.03.12 N750 Firmware 1.04.16 N900 Firmware 1.05.12 N900 Firmware 1.06.18 N900 Firmware 1.06.28 N900C Firmwar...

Western Digital My Net Password Disclosure

Vulnerable Systems: Western Digital My Net Series Wireless Routers: N600 Firmware 1.03.12 N600 Firmware 1.04.16 N750 Firmware 1.03.12 N750 Firmware 1.04.16 N900 Firmware 1.05.12 N900 Firmware 1.06.18 N900 Firmware 1.06.28 N900C Firmware 1.05.12 N900C Firmware 1.06.18 N900C Firmware 1.06.28 CVE...

Server Misconfiguration discloses passwords of all Barracuda Network Employees

Security expert Ebrahim Hegazy has found a Password disclosure vulnerability in Barracuda update servers which allows to gain access to employee credentials. The Egyptian information security advisor Ebrahim Hegazy@Zigoo0 has found a Password disclosure vulnerability in one of Barracuda update...

Oracle Linux 6 : 389-ds-base (ELSA-2012-0997)

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2012-0997 advisory. 1.2.10.2-18 - Resolves: Bug 830001 - unhasheduserpassword visible after changing password -- patch 0020 disallows users' direct modify on...

Multiple Vendors IPMI 2.0 Authentication Bypass via Cipher 0

Authentication Bypass vulnerability have been reported in IPMI 2.0 Authentication. When using cipher type 0, it is an indicator that the client wants to use clear-text authentication,that allows access with any password...

Canon Printer DoS / Secret Disclosure

The below 3 issues have been tested and verified working on the following Canon Printer models May affect more, but this is all I was able to test against: MG3100, MG5300, MG6100, MP495, MX340, MX870, MX890, MX920 1 CVE-2013-4613: Canon printers do not require a password for the administrative...

Brickcom 100ap Series Authentication Bypass / CSRF

============================================================================ BRICKCOM ==================================================================== ============================================================================ 1.Advisory Information Title: Brickcom 100ap Series Vulnerabiliti...

Airlive IP Cameras - Multiple Vulnerabilities

=========================================================================== AIRLIVE ==================================================================== =========================================================================== 1.Advisory Information Title: Airlive Multiple Vulnerabilities Date...

Airlive CSRF / Traversal / Disclosure / Denial Of Service

=========================================================================== AIRLIVE ==================================================================== =========================================================================== 1.Advisory Information Title: Airlive Multiple Vulnerabilities Date...

JBoss AS Administrative Console Password Disclosure

Product: Embedded Jopr - JBoss AS Administration Console Vendor: Red Hat Middleware, LLC Version: JBoss AS Resources Datasources 2. Select Datasource 3. View page source 4. Find input type="password" 5. "value=" will contain the database password. 6. Dump database. Vendor Notified: Yes Vendor...

Passwords of configured SMTP mail accounts are stored in cleartext

panel:bgColor=e7f4fa NOTE: This suggestion is for Confluence Cloud. Using Confluence Server? See the corresponding suggestion|http://jira.atlassian.com/browse/CONFSERVER-29534. panel Passwords for configured mail accounts are stored in clear text in the database as can be seen e.g. by: code SELEC...

Minor flaw allows Hacker to hijack Avira Antivirus customers accounts

Cross site scripting vulnerabilities are mistakenly considered unimportant, but they could allow attackers to inject client-side script in web pages visited by victims. A cross-site scripting xss vulnerability may be exploited by hackers to bypass access controls going beyond the exceptions. An...

Netgear WNR1000 - Authentication Bypass

Exploit for hardware platform in category web applications The web server running on the affected devices is subject to an authentication bypass issue that allows attacker to gain administrative access, circumventing existing authentication mechanisms. Strictly speaking, the web server skips...