Design/Logic Flaw

Multiple vulnerabilities in Cisco Business 220 Series Smart Switches firmware could allow an attacker with Administrator privileges to access sensitive login credentials or reconfigure the passwords on the user account. For more information about these vulnerabilities, see the Details section of...

CVE-2021-34744 Cisco Business 220 Series Smart Switches Static Key and Password Vulnerabilities

Multiple vulnerabilities in Cisco Business 220 Series Smart Switches firmware could allow an attacker with Administrator privileges to access sensitive login credentials or reconfigure the passwords on the user account. For more information about these vulnerabilities, see the Details section of...

CVE-2021-34757 Cisco Business 220 Series Smart Switches Static Key and Password Vulnerabilities

Multiple vulnerabilities in Cisco Business 220 Series Smart Switches firmware could allow an attacker with Administrator privileges to access sensitive login credentials or reconfigure the passwords on the user account. For more information about these vulnerabilities, see the Details section of...

Cisco Business 220 Series Smart Switches Static Key and Password Vulnerabilities

Multiple vulnerabilities in Cisco Business 220 Series Smart Switches firmware could allow an attacker with Administrator privileges to access sensitive login credentials or reconfigure the passwords on the user account. For more information about these vulnerabilities, see the Details "details"...

TangleBot Android malware hijacks phone to steal login credentials

By Waqas Another day, another Android malware - This time it is called TangleBot malware whose entire modus operandi involves stealing your password. This is a post from HackRead.com Read the original post: TangleBot Android malware hijacks phone to steal login credentials...

New BloodyStealer malware steals data from gamers on EA, Epic, Steam

By Waqas The BloodyStealer malware is sold on Russian hacking forums while its capabilities include stealing gaming logs, login credentials, and much more. This is a post from HackRead.com Read the original post: New BloodyStealer malware steals data from gamers on EA, Epic, Steam...

Hackers dump login credentials of Fortinet VPN users in plain-text

By Waqas Fortinet VPN users are urged to reset their passwords as the company has acknowledged the data to be legitimate. This is a post from HackRead.com Read the original post: Hackers dump login credentials of Fortinet VPN users in plain-text...

CVE-2020-19137

Incorrect Access Control in Autumn v1.0.4 and earlier allows remote attackers to obtain clear-text login credentials via the component "autumn-cms/user/getAllUser/?page=1&limit=10"...

CVE-2020-19137

Incorrect Access Control in Autumn v1.0.4 and earlier allows remote attackers to obtain clear-text login credentials via the component "autumn-cms/user/getAllUser/?page=1&limit=10"...

Improper access control

Incorrect Access Control in Autumn v1.0.4 and earlier allows remote attackers to obtain clear-text login credentials via the component "autumn-cms/user/getAllUser/?page=1&limit=10"...

CVE-2020-19137

CVE-2020-19137 affects Autumn v1.0.4 and earlier. The root cause is incorrect access control in the Autumn CMS, enabling remote attackers to obtain clear-text login credentials via the endpoint autumn-cms/user/getAllUser/?page=1&limit=10. Provided connected documents confirm the specific vulnerab...

CVE-2020-19137

Incorrect Access Control in Autumn v1.0.4 and earlier allows remote attackers to obtain clear-text login credentials via the component "autumn-cms/user/getAllUser/?page=1&limit=10"...

Reddit: com.reddit.frontpage vulernable to Task Hijacking (aka StrandHogg Attack)

Summary: The app com.reddit.frontpage is vulnerable to Task Hijacking used by widespread Android trojans. Task hijacking allows malicious apps to inherit permissions of vulnerable apps and is usually used for phishing login credentials of victims. Impact: Assuming a malicious actor want's to grab...

Threat Source newsletter (Aug. 26, 2021)

Newsletter compiled by Jon Munshaw.Good afternoon, Talos readers. We have RATs on RATs on RATs over the past few weeks. And last week, we found a few more heading to Latin America to target users and try to steal their login credentials. The threat actor in this case has some compelling... This i...

Police Crime Record Management System 1.0 - 'casedetails' SQL Injection

Exploit Title: Police Crime Record Management System 1.0 - 'casedetails' SQL Injection Date: 12/08/2021 Exploit Author: Ömer Hasan Durmuş Software Link: https://www.sourcecodester.com/php/14894/police-crime-record-management-system.html Version: v1.0 Category: Webapps Tested on: Linux/Windows Ste...

Vulnerability fixed in Lynx

A vulnerability has been fixed in Lynx. A malicious person at remote can exploit the vulnerability to obtain login credentials sent over HTTPS via Lynx to a server. transmitted. To do this, the malicious party must have access to network traffic between the victim and the server. It is not...

Vulnerability fixed in Elasticsearch

A vulnerability has been fixed in Elasticsearch. A malicious party can exploit the vulnerability to access system memory through a rogue query. In this way also obtain login credentials. Elastic has released updates to fix the vulnerability in Elasticsearch. For more information, see:...

Vulnerabilities fixed in Icinga Web

Vulnerabilities have been fixed in Icinga Web. A malicious person could exploit the vulnerabilities to gain access to sensitive data, including login credentials to underlying systems such as Databases. Also, a malicious party could potentially cause a Denial-of-Service cause. Icinga has released...

Nameless malware stole 26m login credentials from 3.25m computers

By Habiba Rashid The total amount of data collected by the malware includes 26 million login credentials holding 1.1 million unique email addresses. This is a post from HackRead.com Read the original post: Nameless malware stole 26m login credentials from 3.25m computers...

Logic flaw vulnerability in hera task scheduling system

hera task scheduler is a distributed task scheduler based on zeus rewrite. The hera Task Scheduler suffers from a logic flaw that can be exploited by an attacker to forge arbitrary login credentials via a built-in hard-coded key...