2989 matches found
Netop Remote Control 11.52 / 12.11 Credential Issue
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Advisory ID: SYSS-2015-025 Product: Netop Remote Control Vendor: Netop Affected Versions: 11.52, 12.11 Tested Versions: 11.52, 12.11 Vulnerability Type: Use of Hard-coded Cryptographic Key CWE-321 Insufficiently Protected Credentials CWE-522 Risk...
Multiple Huawei ME906 Products Information Disclosure Vulnerability
Huawei ME906 is a mobile internet module with M.2 which supports LTE, WCDMA, EVDO and GSM. Several Huawei ME906 products contain hashes of root accounts and passwords, allowing attackers to exploit vulnerabilities that can be cracked to obtain ROOT account password information...
Cisco TelePresence Video Communication Server Expressway Password Hash Acquisition Vulnerability
Cisco TelePresence Video Communication Server is a video conferencing solution that integrates h.323 and SIP. A security vulnerability exists in Cisco TelePresence Video Communication Server Expressway that allows an authenticated user to download a snapshot of the system and obtain password hash...
WordPress WP Symposium Plugin 15.1 - SQL Injection Vulnerability
Exploit for php platform in category web applications Exploit Title: Wordpress Plugin wp-symposium Unauthenticated SQL Injection Vulnerability Date: 2015-07-30 Exploit Author: PizzaHatHacker Vendor Homepage: http://www.wpsymposium.com/ Version: ? = version = 15.5.1 Tested on: Apache / WordPress...
WordPress Plugin WP Symposium 15.1 - Blind SQL Injection
Details ================ Software: WP Symposium Version: 15.1 Homepage: https://wordpress.org/plugins/wp-symposium Advisory report: https://security.dxw.com/advisories/blind-sql-injection-in-wp-symposium-allows-unauthenticated-attackers-to-access-sensitive-data/ CVE: Awaiting assignment CVSS: 6.4...
WordPress Plugin WP Symposium 15.1 - 'get_album_item.php' SQL Injection
Exploit Title: Wordpress Plugin wp-symposium Unauthenticated SQL Injection Vulnerability Date: 2015-07-30 Exploit Author: PizzaHatHacker Vendor Homepage: http://www.wpsymposium.com/ Version: ? = version = 15.5.1 Contact: PizzaHatHackeragmail.com Tested on: Apache / WordPress 4.2.3 / wp-symposium...
Cisco TelePresence Video Communication Server Expressway Information Disclosure Vulnerability
A vulnerability in the System Snapshot of Cisco TelePresence Video Communication Server VCS Expressway could allow an authenticated, remote attacker to view sensitive data. The vulnerability is due to insufficient protection of data at rest. An attacker could exploit this vulnerability by...
Oracle Endeca Information Discovery Integrator ETL Server Authentication Bypass Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on vulnerable instances of Oracle Endeca Information Discovery. Authentication is not required to exploit this vulnerability. The specific flaw exists within the generation and use of session hashes. The issue lies in the use of...
NewStatPress <= 1.0.4 - SQL Injection
The Search functionality is susceptible to a SQL Injection attack due to usage of user input without sanitation. In particular, at line 98 of 'includes/nspsearch.php'. Utilising a specially crafted SQL query, we can trigger disclosure of user hashes through an IMG tag as the data channel. The...
CollabNet Subversion Edge weak password storage mechanism
Vuln Title: The CollabNet Subversion Edge stores passwords as unsalted MD5 hashes Date: 28.06.2015 Author: otr Software Link: https://www.open.collab.net/downloads/svnedge Vendor: CollabNet Version: 4.0.11 Tested on: Fedora Linux Type: Insecure password storage Risk: Medium Status: public/fixed...
LastPass Network Breached; Calls for Master Password Reset
Password manager LastPass disclosed today that its network was breached and advised users to change their master passwords and enable multifactor authentication. CEO and founder Joe Siegrist said in a security notice that LastPass on Friday discovered suspicious activity on its network; encrypted...
HP WebInspect 10.4 XML External Entity
Exploit Title: HP WebInspect - XML External Entity Date: 23\04\2015 Exploit Author: Jakub Palaczynski Vendor Homepage: http://www.hp.com/ Version: 10.4, 10.3, 10.2, 10.1, 10.0, 9.x, 8.x, 7.x CVE : CVE-2015-2125 1. Create website that exploits vulnerability. 1.1. Website that steals files using OO...
HP WebInspect 10.4 - XML External Entity Injection
HP WebInspect 10.4 - XML External Entity Injection Exploit Title: HP WebInspect - XML External Entity Date: 23\04\2015 Exploit Author: Jakub Palaczynski Vendor Homepage: http://www.hp.com/ Version: 10.4, 10.3, 10.2, 10.1, 10.0, 9.x, 8.x, 7.x CVE : CVE-2015-2125 1. Create website that exploits...
Burning Board 2.3.1 - SQL Injection
Burning Board 2.3.1 - SQL Injection Burning Board SQL Injection Vendor: Woltlab GmbH Product: Burning Board Version: = 2.3.1 Website: http://www.woltlab.de/ BID: 13643 CVE: CVE-2005-1642 OSVDB: 16575 SECUNIA: 15395 PACKETSTORM: 39262 Description: Burning Board is a popular, multi purpose forum /...
Burning Board < 2.3.1 - SQL Injection
Burning Board SQL Injection Vendor: Woltlab GmbH Product: Burning Board Version: = 2.3.1 Website: http://www.woltlab.de/ BID: 13643 CVE: CVE-2005-1642 OSVDB: 16575 SECUNIA: 15395 PACKETSTORM: 39262 Description: Burning Board is a popular, multi purpose forum / community software offered by WoltLa...
TelescopeJS Password Hash Information Disclosure Vulnerability
TelescopeJS is a suite of open source social news applications. An information disclosure vulnerability exists in TelescopeJS, which allows remote attackers to exploit the vulnerability to obtain sensitive information about password hashes...
Windows Domain Controller Hashdump
This module attempts to copy the NTDS.dit database from a live Domain Controller and then parse out all of the User Accounts. It saves all of the captured password hashes, including historical ones. This module requires Metasploit: https://metasploit.com/download Current source:...
Mandriva Linux Security Advisory : setup (MDVSA-2015:208)
Updated setup package fixes security vulnerability : An issue has been identified in Mandriva Business Server 2's setup package where the /etc/shadow and /etc/gshadow files containing password hashes were created with incorrect permissions, making them world-readable mga14516. This update fixes...
[ MDVSA-2015:184 ] setup
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2015:184 http://www.mandriva.com/en/support/security/ Package : setup Date : March 30, 2015 Affected: Business Server 2.0 Problem Description: Updated setup package fixes security vulnerability: An issue has been...
