Tlen Credential Gatherer

This module searches for Tlen credentials on a Windows host. Tlen is a free Polish instant messaging service. Module Options msf use post/windows/gather/credentials/tlen msf posttlen show actions ...actions... msf posttlen set ACTION msf posttlen show options ...show and set options... msf posttl...

Zoho ManageEngine ADSelfService Plus Access Control Error Vulnerability

ZOHO zoho manageengine adselfservice plus is a web-based end-user password management software from ZOHO. zoho ManageEngine ADSelfService Plus 6103 and earlier versions are vulnerable to an access control error that could be exploited by an attacker via the X The vulnerability can be exploited to...

TYPO3 server-side request forgery vulnerability

TYPO3 is a free and open source content management system framework CMS/CMF of the Swiss TYPO3 Typo3 Association. A server-side request forgery vulnerability exists in TYPO3 versions prior to 7.2.1, which stems from a failure to check the legitimacy of a request. An attacker can exploit this...

Cost of Account Unlocks, and Password Resets Add Up

There are many labor-intensive tasks that the IT service desk carries out on a daily basis. None as tedious and costly as resetting passwords. Modern IT service desks spend a significant amount of time both unlocking and resetting passwords for end-users. This issue has been exacerbated by the...

[SECURITY] Fedora 34 Update: gnome-user-docs-40~rc-1.fc34

This package contains end-user documentation for the GNOME desktop environment...

SAP Solution Manager Missing Authentication (2890213)

The version of SAP Solution Manager SAP on the remote host may be affected by a missing authentication vulnerability in the End user Experience Monitoring EEM function due to a lack of authentication checks for a service. An unauthenticated, remote attacker can exploit this issue to compromise al...

Beware! Fully-Functional Exploit Released Online for SAP Solution Manager Flaw

Cybersecurity researchers have warned of a publicly available fully-functional exploit that could be used to target SAP enterprise software. The exploit leverages a vulnerability, tracked as CVE-2020-6207, that stems from a missing authentication check in SAP Solution Manager SolMan version 7.2 S...

Schneider Electric EcoStruxure Geo SCADA Expert License Issue Vulnerability

Schneider Electric EcoStruxure Geo SCADA Expert ClearSCADA is a suite of data acquisition and monitoring software SCADA from Schneider Electric, France. EcoStruxure Geo SCADA Expert 2019 has a security vulnerability that stems from insufficient credential protection, which could result in risk...

CVE-2020-26836

SAP Solution Manager Trace Analysis, version - 720, allows for misuse of a parameter in the application URL leading to Open Redirect vulnerability, an attacker can enter a link to malicious site which could trick the user to enter credentials or download malicious software, as a parameter in the...

Open redirect

SAP Solution Manager Trace Analysis, version - 720, allows for misuse of a parameter in the application URL leading to Open Redirect vulnerability, an attacker can enter a link to malicious site which could trick the user to enter credentials or download malicious software, as a parameter in the...

October CMS Cross-Site Scripting Vulnerability

October CMS is an open source content management system CMS based on PHP and the Laravel web application framework. A security vulnerability exists in October CMS versions 1.0.319 and 1.0.469 that allows a back-end user with upload file privileges to upload SVG files without any processing of the...

Product release: Virtuozzo Hybrid Infrastructure 4.0 (4.0.0-734)

In this release, Virtuozzo Hybrid Infrastructure provides a wide range of new features that enhance the end-user experience and service providers' interoperability. The improvements cover networking, storage core, appliance, object storage, monitoring, performance charts, and localization...

Enterprise Threat Protector Now Includes One-Click Performance Optimization for Microsoft 365

Microsoft 365 is becoming the essential productivity suite for enterprises. Over 1 million companies have now signed up for the service, and every month there are more than 200 million active users. Microsoft Teams alone has 75 million active users every day. If your company already uses or is...

CVE-2020-15408

An issue was discovered in Pulse Secure Pulse Connect Secure before 9.1R8. An authenticated attacker can access the admin page console via the end-user web interface because of a rewrite...

CVE-2020-15408

Pulse Connect Secure (PCS) before 9.1R8 is affected by CVE-2020-15408. An authenticated attacker can access the admin page console via the end-user web interface due to a rewrite. This is documented in multiple sources (NVD/NIST entry and Pulse advisory SA44516). The issue’s impact is limited to ...

CVE-2020-15408

An issue was discovered in Pulse Secure Pulse Connect Secure before 9.1R8. An authenticated attacker can access the admin page console via the end-user web interface because of a rewrite. Recent assessments: wvu-r7 at July 28, 2020 6:20pm UTC reported: I wonder if this has SSRF-to-RCE potential...

CVE-2020-3263 Cisco Webex Meetings Desktop App URL Filtering Arbitrary Program Execution Vulnerability

A vulnerability in Cisco Webex Meetings Desktop App could allow an unauthenticated, remote attacker to execute programs on an affected end-user system. The vulnerability is due to improper validation of input that is supplied to application URLs. The attacker could exploit this vulnerability by...

Default credentials

An insecure-credentials flaw was found in all openstack-cinder versions before openstack-cinder 14.1.0, all openstack-cinder 15.x.x versions before openstack-cinder 15.2.0 and all openstack-cinder 16.x.x versions before openstack-cinder 16.1.0. When using openstack-cinder with the Dell EMC ScaleI...

Access Control Error Vulnerability in Multiple Emerson Electric Products

Emerson Electric Wireless 1410 Gateway and others are a smart wireless gateway product from Emerson Electric USA. The Emerson Electric Wireless 1410 Gateway version 4.6.43 through 4.7.84, the Wireless 1420 Gateway version 4.6.43 through 4.7.84, and the Wireless 1552WU Gateway version 4.6.43 throu...

Empowering your remote workforce with end-user security awareness

COVID-19 has rapidly transformed how we all work. Organizations need quick and effective user security and awareness training to address the swiftly changing needs of the new normal for many of us. To help our customers deploy user training quickly, easily and effectively, we are announcing the...