TBK DVR4104 / DVR4216 - Credentials Leak

-- coding: utf-8 -- import json import requests import argparse import tableprint as tp class Colors: BLUE = '\03394m' GREEN = '\03332m' RED = '\0330;31m' DEFAULT = '\0330m' ORANGE = '\03333m' WHITE = '\03397m' BOLD = '\0331m' BRCOLOUR = '\0331;37;40m' banner = ''' ..--.. ..... .-- ..... . .": "-...

TBK DVR4104 DVR4216 - Credentials Leak

TBK DVR4104 DVR4216 - Credentials Leak -- coding: utf-8 -- import json import requests import argparse import tableprint as tp class Colors: BLUE = '\03394m' GREEN = '\03332m' RED = '\0330;31m' DEFAULT = '\0330m' ORANGE = '\03333m' WHITE = '\03397m' BOLD = '\0331m' BRCOLOUR = '\0331;37;40m' banne...

A cryptocurrency platform exposed sensitive data of 25,000 users

By Waqas Bezop, a cryptocurrency startup exposed highly personal details of more This is a post from HackRead.com Read the original post: A cryptocurrency platform exposed sensitive data of 25,000 users...

Moxa EDR-810 Server Agent Information Disclosure Vulnerability(CVE-2017-12128)

Summary An exploitable information disclosure vulnerability exists in the Server Agent functionality of Moxa EDR-810 V4.1 build 17030317. A specially crafted TCP packet can cause information disclosure. An attacker can send a crafted TCP packet to trigger this vulnerability. Tested Versions Moxa...

The Role That IT Security Teams Need to Play in Connected Hospitals

The WannaCry outbreak that reportedly raked in US$1B in damage costs also forced doctors to cancel scheduled appointments, among other things, brought on warranted concern over pervasive ransomware attacks that could stem from oft-overlooked components of healthcare networks—exposed medical cyber...

Facebook Secretly Provided Analytic Firm Access to Million of Profiles

By Waqas Controversies and scandals on Facebook don’t seem to end anytime This is a post from HackRead.com Read the original post: Facebook Secretly Provided Analytic Firm Access to Million of Profiles...

Unprotected AWS Bucket Exposes 50.4 GB of Financial Giant’s Data

By Waqas Another day, another AWS Bucket exposed to the public - This This is a post from HackRead.com Read the original post: Unprotected AWS Bucket Exposes 50.4 GB of Financial Giant's Data...

Security Constraint Bypass

tomcat-catalina is vulnerable to security constraint bypass. Security constraints are only applied after a servlet has already been loaded. Depending on the order in which the servlets were loaded, its possible that some of the constraints were not applied at all. Leveraging this, users may have...

CVE-2018-1164

This vulnerability allows remote attackers to cause a denial-of-service condition on vulnerable installations of ZyXEL P-870H-51 DSL Router 1.00AWG.3D5. Authentication is not required to exploit this vulnerability. The specific flaw exists within numerous exposed CGI endpoints. The vulnerability ...

ABB netCADOPS Web Application

CVSS v3 5.8 ATTENTION: Remotely exploitable/low skill level to exploit. Vendor: ABB Equipment: netCADOPS Web Application Vulnerability: Information Exposure AFFECTED PRODUCTS The following versions of netCADOPS Web Application, a web interface, are affected: netCADOPS Web Application Version 3.4...

Design/Logic Flaw

An issue was discovered in config/error.php in Anchor 0.12.3. The error log is exposed at an errors.log URI, and contains MySQL credentials if a MySQL error such as "Too many connections" has occurred...

CVE-2017-15712

CVE-2017-15712 affects Apache Oozie before fixes: vulnerable versions include 3.1.3-incubating up to 4.3.0 and 5.0.0-beta1. The issue allows a remote attacker to obtain private files on the Oozie server by crafting a workflow XML that references sensitive files via XML directives/configuration. T...

Dropbox: Exposed Git Repo at http://fileserver.dropboxbusiness.com

The report revealed an exposed git repository on a vendor that Dropbox uses. This endpoint could allow an attacker to retrieve much of the source code and git history for this service which could potentially reveal sensitive information like application secrets. Thankfully, after performing an...

CVE-2017-17406

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Netgain Enterprise Manager. Authentication is not required to exploit this vulnerability. The specific flaw exists within an exposed RMI registry, which listens on TCP ports 1800 and 1850 by defaul...

Some Basic Rules for Securing Your IoT Stuff

Most readers here have likely heard or read various prognostications about the impending doom from the proliferation of poorly-secured "Internet of Things" or IoT devices. Loosely defined as any gadget or gizmo that connects to the Internet but which most consumers probably wouldn't begin to know...

Virtual Reality (VR) Porn App Exposed Personal Data of 20k Users

By Waqas Virtual Reality apps can be fun to use but they This is a post from HackRead.com Read the original post: Virtual Reality VR Porn App Exposed Personal Data of 20k Users...

CVE-2017-17877

An issue was discovered in Valve Steam Link build 643. When the SSH daemon is enabled for local development, the device is publicly available via IPv6 TCP port 22 over the internet with stateless address autoconfiguration by default, which makes it easier for remote attackers to obtain access by...

Genexis Automatic Provisioning System Access Control Vulnerability

The Genexis Automatic Provisioning System GAPS is a system for automatic configuration of routers and networks from the Dutch company GENEXIS. An access control vulnerability exists in GAPS 7.2 and earlier versions. An attacker can exploit this vulnerability to obtain configured setup information...

CVE-2017-0301

In F5 BIG-IP APM software versions 11.5.0, 11.5.1, 11.5.2, 11.5.3, 11.5.4, 11.6.0, 11.6.1, 12.0.0, 12.1.0, 12.1.1 and 12.1.2 BIG-IP APM portal access requests do not return the intended resources in some cases. This may allow access to internal BIG-IP APM resources, however the application...

Genexis GAPS 7.2 Access Control

CVE-2017-6094 - Genexis GAPS Access Control Vulnerability Product: Genexis Automatic Provisioning System GAPS Vendor: Genexis B.V. CVE ID: CVE-2017-6094 Subject: Access control vulnerability Effect: Leaked configuration settings, including user credentials Author: Antoine Neuenschwander Date:...