Google Chrome HTTP Authentication Spoofing Vulnerability (CNVD-2019-38241)

Google Chrome is a web browser from Google, an American company. A security vulnerability exists in Google Chrome versions prior to 78.0.3904.70. A remote attacker can exploit the vulnerability to spoof HTTP authentication windows and gain unauthorized access to user credentials...

Missing permission checks in google-kubernetes-engine allowed validating and obtaining data

Missing permission checks in google-kubernetes-engine allowed users with Overall/Read permission to obtain limited information about the scope and access of a credential with an attacker-specified credential ID obtained through another method. google-kubernetes-engine now requires Job/Configure...

The vulnerability of the Jenkins Credentials plugin, related to the leakage of file and directory information, allows attackers to create or update credentials and gain access to files containing PKCS#12 certificates.

The vulnerability of the Jenkins Credentials plugin is related to the leakage of information about files and directories. Exploiting this vulnerability allows a malicious actor to create or update credentials and gain access to files containing PKCS12 certificates...

IBM Robotic Process Automation with Automation Anywhere Trust Management Issue Vulnerability

IBM Robotic Process Automation with Automation Anywhere is a suite of process automation solutions from IBM USA. IBM Robotic Process Automation with Automation Anywhere has a trust management issue vulnerability that can be exploited by an attacker to brute-force break account credentials...

CVE-2019-12289

An issue was discovered in upgradefirmware.cgi on VStarcam 100T C7824WIP CH-sys-48.53.75.119123 and 200V C38S CH-sys-48.53.203.119123 devices. A remote command can be executed through a system firmware update without authentication. The attacker can modify the files within the internal firmware o...

PT-2019-2636 · Jenkins · Jenkins Credentials Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Credentials Plugin versions 2.1.18 and earlier Description: The issue allows users with permission to create or update credentials to confirm the existence of files on the Jenkins master with an attacker-specified path and obtain the...

Cisco Expressway Series Directory Traversal Vulnerability

A vulnerability in the management web interface of Cisco Expressway Series could allow an authenticated, remote attacker to perform a directory traversal attack against an affected device. The vulnerability is due to insufficient input validation on the web interface. An attacker could exploit th...

CVE-2019-3779

Cloud Foundry Container Runtime, versions prior to 0.29.0, deploys Kubernetes clusters utilize the same CA Certificate Authority to sign and trust certs for ETCD as used by the Kubernetes API. This could allow a user authenticated with a cluster to request a signed certificate leveraging the...

CVE-2018-1000410

CVE-2018-1000410 is an information-disclosure vulnerability affecting Jenkins 2.145 and earlier, and LTS 2.138.1 and earlier, tied to the Stapler framework. The issue resides in core/src/main/java/org/kohsuke/stapler/RequestImpl.java and core/src/main/java/hudson/model/Descriptor.java, enabling a...

Unspecified Vulnerability in Technicolor TC7110.AR

Technicolor TC7110.AR is a cable modem from the French Technicolor group. A security vulnerability exists in Technicolor TC7110.AR STD version 3.38.03. A remote attacker could exploit the vulnerability to obtain Wi-Fi credentials by sending an SNMP request...

CVE-2018-18810

The Administrator Service component of TIBCO Software Inc.'s TIBCO Managed File Transfer Command Center, and TIBCO Managed File Transfer Internet Server contains vulnerabilities where an authenticated user with specific privileges can gain access to credentials to other systems. Affected releases...

CVE-2018-17933

VGo Robot Versions 3.0.3.52164 and 3.0.3.53662. Prior versions may also be affected connected to the VGo XAMPP. User accounts may be able to execute commands that are outside the scope of their privileges and within the scope of an admin account. If an attacker has access to VGo XAMPP Client...

Comparison of Open Source Adversary Emulation Tools

PenTestIT RSS Feed If you liked my older post titled "List of Adversary Emulation Tools", I am sure you must want to know what is the difference or comparison between the different tools. This post is an attempt to do just that -to list down the comparison of open source adversary emulation tools...

Nextcloud Server Authorization Issues Vulnerability

Nextcloud is a client-server software suite for creating network hard disks. An authorization issue vulnerability exists in versions of Nextcloud Server prior to 12.0.3, which can be exploited by an attacker to obtain user credentials and bypass two-factor authentication...

CVE-2018-11195

Mahara 17.04 before 17.04.8 and 17.10 before 17.10.5 and 18.04 before 18.04.1 are vulnerable to the browser "back and refresh" attack. This allows malicious users with physical access to the web browser of a Mahara user, after they have logged in, to potentially gain access to their Mahara...

CVE-2018-11195

Mahara is affected in versions 17.04 before 17.04.8; 17.10 before 17.10.5; and 18.04 before 18.04.1. The vulnerability is described as a browser “back and refresh” attack that, after a user has logged in, could allow a malicious user with physical access to the user’s browser to potentially obtai...

CVE-2017-9317

Privilege escalation vulnerability found in some Dahua IP devices. Attacker in possession of low privilege account can gain access to credential information of high privilege account and further obtain device information or attack the device...

Honeybits - A Simple Tool Designed To Enhance The Effectiveness Of Your Traps By Spreading Breadcrumbs & Honeytokens Across Your Systems

A simple tool designed to enhance the effectiveness of your traps by spreading breadcrumbs & honeytokens across your production servers and workstations to lure the attacker toward your honeypots. Author: Adel "0x4D31" Karimi. Background The problem with the traditional implementation of honeypot...

Dell EMC Avamar and Integrated Data Protection Appliance Installation Manager Incorrect Access Control Vulnerability

Dell EMC Avamar Server and EMC Integrated Data Protection Appliance are both products of Dell Inc.Dell EMC Avamar Server is a fully virtualized backup and recovery software for servers.EMC Integrated Data Protection Appliance is a disk-based backup and recovery solution. EMC Integrated Data...

CVE-2017-14111

The workstation logging function in Philips IntelliSpace Cardiovascular ISCV 2.3.0 and earlier and Xcelera R4.1L1 and earlier records domain authentication credentials, which if accessed allows an attacker to use credentials to access the application, or other user entitlements...