PT-2018-8506

Name of the Vulnerable Software and Affected Versions Dahua IP devices affected versions not specified Description A privilege escalation issue has been discovered, allowing an attacker with a low-privilege account to access credential information of a high-privilege account. This can lead to the...

Honeybits - A Simple Tool Designed To Enhance The Effectiveness Of Your Traps By Spreading Breadcrumbs & Honeytokens Across Your Systems

A simple tool designed to enhance the effectiveness of your traps by spreading breadcrumbs & honeytokens across your production servers and workstations to lure the attacker toward your honeypots. Author: Adel "0x4D31" Karimi. Background The problem with the traditional implementation of honeypot...

Dell EMC Avamar and Integrated Data Protection Appliance Installation Manager Incorrect Access Control Vulnerability

Dell EMC Avamar Server and EMC Integrated Data Protection Appliance are both products of Dell Inc.Dell EMC Avamar Server is a fully virtualized backup and recovery software for servers.EMC Integrated Data Protection Appliance is a disk-based backup and recovery solution. EMC Integrated Data...

CVE-2017-14111

The workstation logging function in Philips IntelliSpace Cardiovascular ISCV 2.3.0 and earlier and Xcelera R4.1L1 and earlier records domain authentication credentials, which if accessed allows an attacker to use credentials to access the application, or other user entitlements...

CVE-2017-16524

Web Viewer 1.0.0.193 on Samsung SRN-1670D devices suffers from an Unrestricted file upload vulnerability: 'networksslupload.php' allows remote authenticated attackers to upload and execute arbitrary PHP code via a filename with a .php extension, which is then accessed via a direct request to the...

NQ Contacts Backup&Restore Access Gain Vulnerability

NQ Contacts Backup&Restore application for Android is a set of data backup and recovery software based on Android platform. A security vulnerability exists in version 1.1 of the NQ Contacts Backup&Restore application for Android, which originates from the program's use of an RC4 static key. The...

CVE-2017-15997: Use of a Broken or Risky Cryptographic Algorithm

In the "NQ Contacts Backup & Restore" application 1.1 for Android, RC4 encryption is used to secure the user password locally stored in shared preferences. Because there is a static RC4 key, an attacker can gain access to user credentials more easily by leveraging access to the preferences XML fi...

PT-2017-14349

Name of the Vulnerable Software and Affected Versions NQ Contacts Backup & Restore version 1.1 Description The issue concerns the use of a static RC4 key for encryption in the application, which can allow an attacker to more easily gain access to user credentials by accessing the preferences XML...

CVE-2017-1000094

The CVE-2017-1000094 entry concerns the Jenkins Docker Commons Plugin. The exposed issue is that the plugin enumerates credential IDs without proper permission checks, allowing any user with Overall/Read permission to retrieve a list of valid credentials IDs. This can facilitate credential theft ...

PT-2017-16092

Name of the Vulnerable Software and Affected Versions LXCA versions prior to 1.3.2 Description An attacker with access to the location where the LXCA file system is stored may be able to access credentials of local LXCA accounts. Recommendations For LXCA versions prior to 1.3.2, update to version...

The vulnerability of the application interface of the IBM WebSphere Portal server allows a hacker to gain access to user credentials.

The vulnerability of the IBM WebSphere Portal application’s user interface exists due to the lack of measures taken to protect the web page structure. Exploiting this vulnerability allows a malicious actor to gain access to user credentials by injecting arbitrary JavaScript code into the Web UI...

PT-2017-18385 · Microsoft · Sql Server Analysis Services +1

Name of the Vulnerable Software and Affected Versions: Microsoft SQL Server Analysis Services versions 2012 through 2016 Description: An information disclosure issue exists due to improper permission enforcement. If an attacker's credentials allow access to an affected SQL server database, they...

Foscam camera firewall misconfiguration vulnerability

Foscam camera is a webcam that pushes messages to your phone and also enables video Baidu cloud storage directly through WIFI. There is a misconfiguration vulnerability in the Foscam camera firewall that allows an attacker to perform a brute force attack on credentials despite the presence of a...

IBM Security Privileged Identity Manager Information Disclosure Vulnerability (CNVD-2017-09514)

IBM Security Privileged Identity Manager ISPIM is an identity management product within IBM Identity Governance and Management, an identity governance solution from IBM Corporation, USA, that protects, automates and audits the use of privileged identities,... It is designed to protect, automate a...

CVE-2016-5757

iManager Admin Console in NetIQ Access Manager 4.1 before 4.1.2 Hot Fix 1 and 4.2 before 4.2.2 was vulnerable to iFrame manipulation attacks, which could allow remote users to gain access to authentication credentials...

CVE-2016-6893

Cross-site request forgery CSRF vulnerability in the user options page in GNU Mailman 2.1.x before 2.1.23 allows remote attackers to hijack the authentication of arbitrary users for requests that modify an option, as demonstrated by gaining access to the credentials of a victim's account...

CVE-2016-6893

Cross-site request forgery CSRF vulnerability in the user options page in GNU Mailman 2.1.x before 2.1.23 allows remote attackers to hijack the authentication of arbitrary users for requests that modify an option, as demonstrated by gaining access to the credentials of a victim's account...

The vulnerability of the Radia Client Automation program allows a hacker to gain access to users’ account credentials.

The vulnerability of the Radia Client Automation program relates to deficiencies in restricting access to certain functions. Exploiting this vulnerability allows a malicious actor to list user accounts through the getUsers request, assign a role to a user account through the addAssigneesToRole...

CVE-2015-7996

The Nitro API in Citrix NetScaler Application Delivery Controller ADC and NetScaler Gateway before 10.1 Build 133.9, 10.5 before Build 58.11, and 10.5.e before Build 56.1505.e on NetScaler Service Delivery Appliance Service VM SVM devices allow attackers to obtain credentials via the browser cach...

DEBIAN-CVE-2015-6524

The LDAPLoginModule implementation in the Java Authentication and Authorization Service JAAS in Apache ActiveMQ 5.x before 5.10.1 allows wildcard operators in usernames, which allows remote attackers to obtain credentials via a brute force attack. NOTE: this identifier was SPLIT from CVE-2014-361...