5885 matches found
CVE-2019-19774
CVE-2019-19774 affects Zoho ManageEngine EventLog Analyzer 10.0 SP1 before Build 12110. An authenticated user can bypass access controls via the /event/runquery.do endpoint by executing the query select hostdetails from hostdetails, bypassing restrictions that prevent viewing credential data and ...
CVE-2019-19774
An issue was discovered in Zoho ManageEngine EventLog Analyzer 10.0 SP1 before Build 12110. By running "select hostdetails from hostdetails" at the /event/runquery.do endpoint, it is possible to bypass the security restrictions that prevent even administrative users from viewing credential data...
PT-2019-15950 · Zoho · Zoho Manageengine Eventlog Analyzer
Name of the Vulnerable Software and Affected Versions: Zoho ManageEngine EventLog Analyzer versions 10.0 SP1 before Build 12110 Description: An issue was discovered that allows bypassing security restrictions, enabling the recovery of MD5 hashes of accounts used to authenticate the ManageEngine...
SUSE SLED12 / SLES12 Security Update : strongswan (SUSE-SU-2019:3266-1)
This update for strongswan provides the following fixes : Security issues fixed : CVE-2018-5388: Fixed a buffer underflow which may allow to a remote attacker with local user credentials to resource exhaustion and denial of service while reading from the socket bsc1094462. CVE-2018-10811: Fixed a...
2.7 billion email addresses & plain-text passwords exposed online
By Waqas In addition to email addresses and passwords, the records contained MD5, SHA1, and SHA256 hashes.... This is a post from HackRead.com Read the original post: 2.7 billion email addresses & plain-text passwords exposed online...
Threat Analysis Unit (TAU) Threat Intelligence Notification: Cyborg Ransomware
Cyborg Ransomware was found being distributed via spear-phishing email campaign which contains a fake “Windows Update” email which appears as a ‘.jpg’ file in the email attachment, but is instead a ‘.exe’ binary file. It tries to tempt users to click on the malicious attachment file in order to...
openSUSE: Security Advisory for strongswan (openSUSE-SU-2019:2594-1)
The remote host is missing an update for the Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...
OPENSUSE-SU-2019:2594-1 Security update for strongswan
This update for strongswan fixes the following issues: Security issues fixed: - CVE-2018-5388: Fixed a buffer underflow which may allow to a remote attacker with local user credentials to resource exhaustion and denial of service while reading from the socket bsc1094462. - CVE-2018-10811: Fixed a...
CVE-2013-7484
Zabbix before 5.0 represents passwords in the users table with unsalted MD5...
CVE-2013-7484
Zabbix before 5.0 represents passwords in the users table with unsalted MD5...
CVE-2013-7484
Zabbix before 5.0 represents passwords in the users table with unsalted MD5...
Code injection
Zabbix before 5.0 represents passwords in the users table with unsalted MD5...
CVE-2013-7484
Zabbix before 5.0 represents passwords in the users table with unsalted MD5...
CVE-2013-7484
Zabbix before 5.0 represents passwords in the users table with unsalted MD5...
Security Bulletin: Vulnerability in IBM Java SDK affects IBM Explorer for z/OS 3.0 (CVE-2015-7575)
Summary There is a vulnerability in IBM® SDK Java™ Technology Edition that is used by IBM Explorer for z/OS V3.0. This vulnerability, commonly referred to as “SLOTH”, was disclosed as part of the IBM Java SDK updates in January 2016. Vulnerability Details CVEID: CVE-2015-7575 DESCRIPTION: The TLS...
dovecot security and bug fix update
1:2.2.36-10 - fix CVE-2019-11500: IMAP protocol parser does not properly handle NUL byte when scanning data in quoted strings, leading to out of bounds heap memory writes 1741788 1:2.2.36-9 - reset errno before iterating through users 1630410 1:2.2.36-8 - fix CVE-2019-3814: improper certificate...
FlexAir Access Control 2.3.35 - Authentication Bypass Exploit
Exploit for hardware platform in category web applications Exploit Title: FlexAir Access Control 2.3.35 - Authentication Bypass Exploit Author: LiquidWorm Vendor Homepage: https://www.computrols.com/capabilities-cbas-web/ Software Link: https://www.computrols.com/building-automation-software/...
Prima FlexAir Access Control 2.3.35 Database Backup Predictable Name
!/usr/bin/env python -- coding: utf8 -- Prima FlexAir Access Control 2.3.35 Database Backup Predictable Name Exploit Authentication Bypass Login with MD5 hash CVE: CVE-2019-7666, CVE-2019-7667 Advisory: https://applied-risk.com/resources/ar-2019-007 Paper:...
FlexAir Access Control 2.3.35 - Authentication Bypass
Exploit Title: FlexAir Access Control 2.3.35 - Authentication Bypass Google Dork: NA Date: 2019-11-11 Exploit Author: LiquidWorm Vendor Homepage: https://www.computrols.com/capabilities-cbas-web/ Software Link: https://www.computrols.com/building-automation-software/ Version: 2.3.35 Tested on: NA...
Optergy BMS 2.0.3a Remote Root
!/usr/bin/env python Unauthenticated Remote Root Exploit in Optergy BMS Console Backdoor Affected version \n' sys.exit while True: challengeurl = 'http://'+sys.argv1+'/tools/ajax/ConsoleResult.html?get' try: req1 = requests.getchallengeurl getchallenge = json.loadsreq1.text challenge =...