Authentication Logic Error Vulnerability in Weetop CMS Backend

Weetop CMS is a web content management system developed by Hangzhou Tintop Technology Co. Weetop CMS V2.0 has an authentication logic error vulnerability in the login function, as a login session is created before a successful login. An attacker can successfully access the backend by performing...

Authentication Bypass Vulnerability in Weetop CMS Backend

Weetop CMS is a web content management system developed by Hangzhou Tintop Technology Co. An authentication bypass vulnerability exists in the Weetop CMS V2.0 administration backend in the login session check processing mechanism. An attacker can bypass the forced jump without login by disabling...

[SECURITY] Fedora 24 Update: dbus-1.11.6-1.fc24

D-BUS is a system for sending messages between applications. It is used both for the system-wide message bus service, and as a per-user-login-session messaging facility...

Hacker finds flaws that could let anyone steal $25 Billion from a Bank

A security researcher could have stolen as much as $25 Billion from one of the India's biggest banks ‒ Thanks to the bank's vulnerable mobile application. Late last year, security researcher Sathya Prakash discovered a number of critical vulnerabilities in the mobile banking application of an...

Isilon OS SmartLock Bypass

The vulnerability of the Isilon operating system OneFS is related to deficiencies in access control. Exploiting this vulnerability allows a malicious actor to circumvent the SmartLock restriction by creating a user account and setting up an login session remotely...

Code injection

IBM Maximo Asset Management 7.1 through 7.1.1.13, 7.5.0 before 7.5.0.8 IFIX005, and 7.6.0 before 7.6.0.2 IFIX002; Maximo Asset Management 7.5.0 before 7.5.0.8 IFIX005, 7.5.1, and 7.6.0 before 7.6.0.2 IFIX002 for SmartCloud Control Desk; and Maximo Asset Management 7.1 through 7.1.1.13 and 7.2 for...

Default credentials

EMC VPLEX GeoSynchrony 5.4 SP1 before P3 and 5.5 before Patch 1 has a default password for the root account, which allows local users to gain privileges by leveraging a login session...

CVE-2015-6850

EMC VPLEX GeoSynchrony 5.4 SP1 before P3 and 5.5 before Patch 1 have a default root password that allows local users to gain privileges by leveraging an active login session. Affected component: root account on GeoSynchrony; root cause: default credential exposed on install; impact: local privile...

CVE-2015-6850

EMC VPLEX GeoSynchrony 5.4 SP1 before P3 and 5.5 before Patch 1 has a default password for the root account, which allows local users to gain privileges by leveraging a login session...

Hardcoded credentials

The login function in the RequestController class in Moxa OnCell Central Manager before 2.2 has a hardcoded root password, which allows remote attackers to obtain administrative access via a login session...

CVE-2015-4306

The web framework in Cisco Prime Collaboration Assurance before 10.5.1.53684-1 allows remote authenticated users to bypass intended login-session read restrictions, and impersonate administrators of arbitrary tenant domains, by discovering a session identifier and constructing a crafted URL, aka...

Code injection

The web framework in Cisco Prime Collaboration Assurance before 10.5.1.53684-1 allows remote authenticated users to bypass intended login-session read restrictions, and impersonate administrators of arbitrary tenant domains, by discovering a session identifier and constructing a crafted URL, aka...

CVE-2015-4306

The web framework in Cisco Prime Collaboration Assurance before 10.5.1.53684-1 allows remote authenticated users to bypass intended login-session read restrictions, and impersonate administrators of arbitrary tenant domains, by discovering a session identifier and constructing a crafted URL, aka...

CVE-2015-4306: Undefined Security Weakness

The web framework in Cisco Prime Collaboration Assurance before 10.5.1.53684-1 allows remote authenticated users to bypass intended login-session read restrictions, and impersonate administrators of arbitrary tenant domains, by discovering a session identifier and constructing a crafted URL, aka...

Default credentials

EMC PowerPath Virtual Appliance aka vApp before 2.0 has default passwords for the 1 emcupdate and 2 svcuser accounts, which makes it easier for remote attackers to obtain potentially sensitive information via a login session...

[SECURITY] Fedora 21 Update: mingw-dbus-1.8.12-1.fc21

D-BUS is a system for sending messages between applications. It is used both for the system wide message bus service, and as a per-user-login-session messaging facility...

[SECURITY] Fedora 20 Update: dbus-1.6.28-1.fc20

D-BUS is a system for sending messages between applications. It is used both for the system-wide message bus service, and as a per-user-login-session messaging facility...

FreeBSD Security Advisory FreeBSD-SA-14:25.setlogin

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-SA-14:25.setlogin Security Advisory The FreeBSD Project Topic: Kernel stack disclosure in setlogin2 / getlogin2 Category: core Module: kernel Announced: 2014-11-04...

Fedora Update for dbus FEDORA-2012-14157

Check for the Version of dbus OpenVAS Vulnerability Test Fedora Update for dbus FEDORA-2012-14157 Authors: System Generated Check Copyright: Copyright c 2012 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under the terms o...

Fedora Update for dbus FEDORA-2010-19166

Check for the Version of dbus OpenVAS Vulnerability Test Fedora Update for dbus FEDORA-2010-19166 Authors: System Generated Check Copyright: Copyright c 2010 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under the terms o...