openstack-glance: Backend password leak in Glance error message

store/swift.py in OpenStack Glance Essex 2012.1, Folsom 2012.2 before 2012.2.3, and Grizzly, when in Swift single tenant mode, logs the Swift endpoint's user name and password in cleartext when the endpoint is misconfigured or unusable, allows remote authenticated users to obtain sensitive...

Cache: NonManagedConnectionFactory will log password in clear text when an exception occurs

The NonManagedConnectionFactory in JBoss Enterprise Application Platform EAP 5.1.2 and 5.2.0, Web Platform EWP 5.1.2 and 5.2.0, and BRMS Platform before 5.3.1 logs the username and password in cleartext when an exception is thrown, which allows local users to obtain sensitive information by readi...

All Veeam services stop at the same time everyday

Challenge Veeam services stop at the same time every night. Cause Microsoft SCCM has a Health Agent Task scheduled to run over night. The task does not support WMI 3.0. WMI 3.0 is incorporated in Veeam Backup & Replication as a dependency. When the Health Agent clears the WMI repository, it kills...

36 Windows Tools For Penetration Testing

Most penetration testers are using either a Mac or a Linux-based platform in order to perform their penetration testing activities.However it is always a good practice to have and a Windows virtual machine with some tools ready to be used for the engagement.The reason for this is that although...

CVE-2012-6494 - Nexpose Security Console - Session Hijacking

Product: Nexpose Security Console Vendor: Rapid7 Version: 5.5.3 Tested Version: 5.5.1 Vendor Notified Date: December 19, 2012 Release Date: January 2, 2013 Risk: Medium Authentication: Access to logs required. Remote: Yes Description: Due to a flaw in the way the Nexpose Security Console logs...

CVE-2010-2387

vicious-extensions/ve-misc.c in GNOME Display Manager gdm 2.20.x before 2.20.11, when GDM debug is enabled, logs the user password when it contains invalid UTF8 encoded characters, which might allow local users to gain privileges by reading the information from syslog logs...

Design/Logic Flaw

vicious-extensions/ve-misc.c in GNOME Display Manager gdm 2.20.x before 2.20.11, when GDM debug is enabled, logs the user password when it contains invalid UTF8 encoded characters, which might allow local users to gain privileges by reading the information from syslog logs...

Loctouch for Android vulnerable in handling of implicit intents

Overview Loctouch for Android contains a vulnerability in the handling of implicit intents. Loctouch provided by NHN Japan, is an application that logs location information. Loctouch for Android contains a vulnerability in the handling of implicit intents. Gaku Mochizuki of Mitsui Bussan Secure...

CVE-2010-2387

vicious-extensions/ve-misc.c in GNOME Display Manager gdm 2.20.x before 2.20.11, when GDM debug is enabled, logs the user password when it contains invalid UTF8 encoded characters, which might allow local users to gain privileges by reading the information from syslog logs...

JVN#42625179: Loctouch for Android vulnerable in handling of implicit intents

Loctouch provided by NHN Japan, is an application that logs location information. Loctouch for Android contains a vulnerability in the handling of implicit intents. Impact Location logs that include non-public information may be leaked to a third party through a malicious Android application...

[SECURITY] Fedora 18 Update: freeipa-3.1.0-1.fc18

IPA is an integrated solution to provide centrally managed Identity machin e, user, virtual machines, groups, authentication credentials, Policy configuration settings, access control information and Audit events, logs, analysis thereof...

WordPress Simple Gmail Login Path Disclosure

Application- Wordpress Plugin Simple Gmail Login Exploit - Stack Trace Error URL- http://wordpress.org/extend/plugins/simple-gmail-login/ Author- Aditya Balapure Link - http://adityabalapure.blogspot.in/ CVE Assigned- CVE-2012-6313. Description Once you have installed this plugin you can login to...

JVN#23563149: KENT-WEB ACCESS REPORT vulnerable to cross-site scripting

ACCESS REPORT provided by KENT-WEB is a software to analyze web access logs. ACCESS REPORT contains a cross-site scripting vulnerability. This is caused by a particular method in which tags are embedded into the web page. Note that this vulnerability is different from JVN68830017. Impact An...

ThinkSNS某SNS功能极品XSS，通杀WEB和IOS客户端Ⅳ

简要描述： 一直缺少个Ⅳ，补上吧 详细说明： 这次出问题的地方仍然在主要的【日志功能】只是做了简单的字符过滤，效果不是很理想 我可以发表如下日志内容 zzR 轻松绕过 右键参看源码 红果果 漏洞证明： 然后说xsserme有个钓鱼功能就试试了 好像有点过于直白，还是说我没有使用好？ 测试是能够收到用户名密码的 不知道有没有上当的- - 接着还是不辞辛苦测试了IOS客户端 https://images.seebug.org/upload/201211/231155539c8af...

CVE-2012-0266

creationtimestamp| type| source ---|---|--- 2012-10-10 00:00:00+00:00| confirmed| https://www.exploit-db.com/exploits/21841 2018-05-29 15:50:33+00:00| seen| https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/ntractivexcheckbof.rb 2025-02-06 03:13:40+00:00|...

CVE-2011-4640

Summary (CVE-2011-4640): A local file inclusion in WebTitan/SpamTitan prior to version 3.60 via logs-x.php (fname parameter in the view action) allows remote authenticated users to read arbitrary files by crafting a dot-dot (“..”) path. The Nuclei template confirms the vulnerability class and aff...

SourceForge Investigates Backdoor Code Found in Copy of phpMyAdmin

The popular open-source repository SourceForge is investigating how a corrupted copy of phpMyAdmin came to be served from a Korean-based mirror. Logs indicate 400 users downloaded the malicious file before it was removed from rotation today. “One of the SourceForge.net mirrors, namely...

Researcher Finds 100k IEEE.org Passwords Stored in Plain-Text on Public FTP Server

A Romanian computer scientist discovered that the Institute of Electrical and Electronics Engineers IEEE was storing its members’ usernames and passwords in plaint-text on a publically accessible file transfer protocol FTP server. Radu Drăgușin claims the collection of nearly 100,000 credentials...

Large-Scale Water Holing Attack Campaigns Hitting Key Targets

A new APT-style espionage campaign launched this summer targeting organizations tied to financial services, government agencies and the defense industry used a technique dubbed water holing to entice victims and silently redirect them to sites hosting zero-day exploits. Researchers at RSA Securit...

CVE-2012-3743

The System Logs implementation in Apple iOS before 6 does not restrict /var/log access by sandboxed apps, which allows remote attackers to obtain sensitive information via a crafted app that reads log files...