336 matches found
SQL Injection Vulnerability in EasyAdmin /application/index/controller/index.php Page
EasyAdmin is a free and open source community program based on the LayUI template, with a ThinkPHP5 framework for backend support. SQL injection vulnerability exists in the EasyAdmin /application/index/controller/index.php page. Attackers can construct a specific URL injection to obtain the...
CVE-2015-5959
Froxlor before 0.9.33.2 with the default configuration/setup might allow remote attackers to obtain the database password by reading /logs/sql-error.log...
Default configuration
Froxlor before 0.9.33.2 with the default configuration/setup might allow remote attackers to obtain the database password by reading /logs/sql-error.log...
CVE-2015-5959
Froxlor before 0.9.33.2 with the default configuration/setup might allow remote attackers to obtain the database password by reading /logs/sql-error.log...
CVE-2015-5959
CVE-2015-5959 affects Froxlor prior to 0.9.33.2, where default installations could disclose the database password by reading the /logs/sql-error.log file. Multiple sources (NVD entry and FreeBSD VuXML) describe an unauthenticated information-disclosure scenario tied to the /logs directory permiss...
SIEMENS SICAM PAS Local Security Bypass Vulnerability
SICAM PAS is an energy automation solution for the operation of substation equipment. It has open communication interfaces for power system control and control of industrial power supply equipment. A local security bypass vulnerability exists in SIEMENS SICAM PAS. An authenticated local attacker...
UBUNTU-CVE-2016-9013
Django 1.8.x before 1.8.16, 1.9.x before 1.9.11, and 1.10.x before 1.10.3 use a hardcoded password for a temporary database user created when running tests with an Oracle database, which makes it easier for remote attackers to obtain access to the database server by leveraging failure to manually...
MyBB 1.8.6 Data Validation
Security Advisory - Curesec Research Team 1. Introduction Affected Product: MyBB 1.8.6 Fixed in: 1.8.7 Fixed Version Link: http://resources.mybb.com/downloads/mybb1807.zip Vendor Website: http://www.mybb.com/ Vulnerability Type: Improper validation of data passed to eval Remote Exploitable: Yes...
DEXIS Imaging Suite 10 contains hard-coded credentials
Overview DEXIS is a dental x-ray imaging software that manages patient records. DEXIS Imaging Suite 10 contains several hard-coded credentials allowing administrative or root access to the patient database. Description CWE-798: Use of Hard-coded Credentials - CVE-2016-6532 DEXIS Imaging Suite 10...
Navicat Premium 11.2.11 (64bit) Local Database Password Disclosure Vulnerability
Navicat premium is a database management tool. Navicat Premium client v11.2.11 suffers from a local password disclosure vulnerability, where the password is stored in plaintext and can be exploited to obtain the database password...
Navicat Premium 11.2.11 (x64) - Local Database Password Disclosure
Navicat Premium 11.2.11 64bit Local Password Disclosure Tested on Windows Windows Server 2012 R2 64bit, English Vendor Homepage @ https://www.navicat.com/ Date 05/09/2016 Bug Discovered by Yakir Wizman https://www.linkedin.com/in/yakirwizman http://www.black-rose.ml Special Thanks & Greetings to...
Yeager CMS 1.2.1 File Upload / SQL Injection / XSS / SSRF
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Multiple Vulnerabilities product: Yeager CMS vulnerable version: 1.2.1 fixed version: 1.3 CVE number: CVE-2015-7567,...
PT-2016-3178 · Siemens · Siemens Sicam Pas
Name of the Vulnerable Software and Affected Versions: Siemens SICAM PAS versions prior to 8.07 Description: The issue is related to insufficient password protection in the database of the Siemens SICAM PAS system, which can be exploited by a local attacker to calculate passwords using certain...
AlienVault Unified Security Management Local Privilege Escalation Vulnerability
This vulnerability allows local attackers to escalate privileges to root on vulnerable installations of AlienVault Unified Security Management. Authentication is not required to exploit this vulnerability. The specific flaw exists within the configuration of the server and database. A local...
froxlor -- database password information leak
[email protected] reports: An unauthenticated remote attacker is able to get the database password via webaccess due to wrong file permissions of the /logs/ folder in froxlor version 0.9.33.1 and earlier. The plain SQL password and username may be stored in the /logs/sql-error.log file...
CVE-2015-2998
SysAid Help Desk before 15.2 uses a hardcoded encryption key, which makes it easier for remote attackers to obtain sensitive information, as demonstrated by decrypting the database password in WEB-INF/conf/serverConf.xml...
CVE-2015-2998
SysAid Help Desk (before version 15.2) is affected by CVE-2015-2998 due to a hardcoded encryption key used to encrypt sensitive data. The vulnerability allows remote attackers to obtain sensitive information by decrypting the database password stored in WEB-INF/conf/serverConf.xml, as demonstrate...
MediaSuite CMS - Artibary File Disclosure
. | | / | | \ \ | | \ / | |\ / / /\ \ / \ | / ^ / / || / / / / /\ /\ \ \ \ | / \ / http://twitter.com/h4SEC / \ | \ \ Proof Video: https://www.youtube.com/watch?v=7yxbfD1YK8Y / // / \ / My + Author : KnocKout E-Mail : [email protected] Twitter: http://twitter.com/h4SEC HomePage :...
[CVE-2014-7301] SGI Tempo System Database Password Exposure
SGI Tempo System Database Password Exposure Software: SGI Tempo SGI ICE-X Supercomputers Affected Versions: Unknown CVE Reference: CVE-2014-7301 Author: John Fitzpatrick, MWR Labs Severity: Medium Risk Vendor: Silicon Graphics International Corp SGI Vendor Response: Uncooperative Description It i...
RHEL 6 : rhevm-log-collector (RHSA-2014:1947)
An updated rhevm-log-collector package that fixes one security issue is now available for Red Hat Enterprise Virtualization 3. Red Hat Product Security has rated this update as having Low security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity ratin...