Debian: Security Advisory (DSA-4044-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

“The 101” – Episode 14 – What Makes Up a Cyberattack? (Part 2)

We’re back with another episode of The 101! This regular security series aims to define endpoint security one question at a time. Tune in each week as we tackle a new term, concept, or comparison in our ongoing effort to provide clear definitions. Last episode we started answering a pivotal...

Catalyst Mahara Mobile Information Disclosure Vulnerability

Catalyst Mahara Mobile is a suite of mobile social networking software from Catalyst IT in New Zealand. A security vulnerability exists in versions of Catalyst Mahara Mobile prior to 1.2.1, which stems from the program sending passwords in clear text to the access log. An attacker could exploit t...

“The 101” – Episode 13 – What Makes Up a Cyberattack? (Part 1)

We’re back with another episode of The 101! This regular security series aims to define endpoint security one question at a time. Tune in each week as we tackle a new term, concept, or comparison in our ongoing effort to provide clear definitions. Sometimes in security we find ourselves using...

DEBIAN-CVE-2017-15185

plugins/ogg.c in Libmp3splt 0.9.2 calls the libvorbis vorbisblockclear function with uninitialized data upon detection of invalid input, which allows remote attackers to cause a denial of service application crash via a crafted file...

IBM BigFix Compliance Analytics Information Disclosure Vulnerability

IBM BigFix Compliance Analytics TEMA SUAv1 SCA SCM is a suite of systems management software from IBM in the United States. The software provides remote control, patch management, software distribution, operating system deployment, network access protection and other functions. A security...

Design/Logic Flaw

IBM BigFix Compliance Analytics 1.9.79 TEMA SUAv1 SCA SCM stores user credentials in clear text which can be read by a local user. IBM X-Force ID: 123676...

CVE-2017-1201

IBM BigFix Compliance Analytics 1.9.79 TEMA SUAv1 SCA SCM stores user credentials in clear text which can be read by a local user. IBM X-Force ID: 123676...

CVE-2017-1201

IBM BigFix Compliance Analytics 1.9.79 TEMA SUAv1 SCA SCM stores user credentials in clear text which can be read by a local user. IBM X-Force ID: 123676...

CVE-2017-1201

IBM BigFix Compliance Analytics 1.9.79 (TEMA SUAv1 SCA SCM) is affected by a vulnerability where the program stores user credentials in clear text, allowing a local attacker to read them. Root cause: credentials stored in clear text within the affected component. Impact: local confidentiality exp...

CVE-2017-1201

IBM BigFix Compliance Analytics 1.9.79 TEMA SUAv1 SCA SCM stores user credentials in clear text which can be read by a local user. IBM X-Force ID: 123676...

CVE-2017-14990

CVE-2017-14990 is confirmed in the connected documents. WordPress 4.8.2 stores cleartext values in wp_signups.activation_key, while wp_users.user_activation_key is stored as a hash, which could enable an attacker with database read access (for example via an unspecified SQL injection) to hijack u...

clear-reports.com XSS vulnerability

Vulnerable URL: https://www.clear-reports.com/track/loadURL.php?url=javascript:alert/OPENBUGBOUNTY/ Details: Description| Value ---|--- Patched:| Yes, at 29.12.2017 Latest check for patch:| 29.12.2017 07:07 GMT Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 148161...

Code injection

MultiTech FaxFinder before 4.1.2 stores Passwords unencrypted for maintaining the test connectivity function of its LDAP configuration. These credentials are retrieved by the system when the LDAP configuration page is opened and are embedded directly into the HTML source code in cleartext...

CVE-2017-1362

IBM Security Identity Manager Adapters 6.0 and 7.0 store user credentials in plaintext, readable by local users. The IBM bulletin confirms unsecured data traffic when SSL is not explicitly enabled; enabling SSL by default and importing valid certificates is recommended. Affected: ISIM v6.0 Adapte...

apps.itsc.cuhk.edu.hk XSS vulnerability

Open Bug Bounty ID: OBB-303429 Description| Value ---|--- Affected Website:| apps.itsc.cuhk.edu.hk Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Ubiquiti Inc.: Remote Code Execution at http://tw.corp.ubnt.com

The researcher found a Command Injection in tw.corp.ubnt.com. While hunting i came across a host of Ubiquiti Networks tw.corp.ubnt.com , when i browsed to http://tw.corp.ubnt.com there was Dir listing enabled which contained various sensitive information. This was reported to Ubiquiti Team. Howev...

Ked Password Manager: Information leak

Background Helps to manage large numbers of passwords and related information and simplifies the tasks of searching and entering password data. Description A history file in /.kedpm/history is written in clear text. All of the commands performed in the password manager are written there. This can...

GLSA-201708-04 : Ked Password Manager: Information leak

The remote host is affected by the vulnerability described in GLSA-201708-04 Ked Password Manager: Information leak A history file in /.kedpm/history is written in clear text. All of the commands performed in the password manager are written there. This can lead to the disclosure of the master...

ALPINE-CVE-2017-12855

Xen maintains the GTFread,writing bits as appropriate, to inform the guest that a grant is in use. A guest is expected not to modify the grant details while it is in use, whereas the guest is free to modify/reuse the grant entry when it is not in use. Under some circumstances, Xen will clear the...