98 matches found
curl: NTLM buffer overflow via integer overflow
The NTLM authentication feature in curl and libcurl before 7.57.0 on 32-bit platforms allows attackers to cause a denial of service integer overflow and resultant buffer overflow, and application crash or possibly have unspecified other impact via vectors involving long user and password fields...
Google Chrome Views Unauthorized Access Vulnerability
Google Chrome is a web browser developed by Google, Inc.Views is one of the view components. A security vulnerability exists in Views in versions of Google Chrome prior to 67.0.3396.62, which stems from a failure to use operating system protection for password fields. An attacker could exploit th...
ALPINE-CVE-2017-8816
The NTLM authentication feature in curl and libcurl before 7.57.0 on 32-bit platforms allows attackers to cause a denial of service integer overflow and resultant buffer overflow, and application crash or possibly have unspecified other impact via vectors involving long user and password fields...
DEBIAN-CVE-2017-8816
The NTLM authentication feature in curl and libcurl before 7.57.0 on 32-bit platforms allows attackers to cause a denial of service integer overflow and resultant buffer overflow, and application crash or possibly have unspecified other impact via vectors involving long user and password fields...
CVE-2017-8816
The NTLM authentication feature in curl and libcurl before 7.57.0 on 32-bit platforms allows attackers to cause a denial of service integer overflow and resultant buffer overflow, and application crash or possibly have unspecified other impact via vectors involving long user and password fields...
Taking HTTPS Denial to an Absurd Level
Sometimes fighting good security is harder than embracing it. That appears to be the case with at least one company that went to great lengths to avoid insecure HTTPS browser security warnings from appearing on the thousands of sites it managed. The company in question is ShopCity.com, a...
Legal Robot: Autocomplete feature
A security researcher discovered that several password fields did not contain the Autocomplete attribute. Thanks to @gujjuboy10x00 for pointing this out!...
Design/Logic Flaw
The web interface in Red Hat QuickStart Cloud Installer QCI 1.0 does not mask passwords fields, which allows physically proximate attackers to obtain sensitive password information by reading the display...
CVE-2016-7060
The web interface in Red Hat QuickStart Cloud Installer QCI 1.0 does not mask passwords fields, which allows physically proximate attackers to obtain sensitive password information by reading the display...
openSUSE: Security Advisory for MozillaFirefox (openSUSE-SU-2017:0690-1)
The remote host is missing an update for the SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
QCI: qci exposes password in web UI when they should be masked
It was found that several password fields in QCI failed to properly mask the password while it was being entered. An attacker with physical access or the ability to view the screen would be able to see the passwords as they are being entered, allowing them to later access accounts and services...
CVE-2016-7060
It was found that several password fields in QCI failed to properly mask the password while it was being entered. An attacker with physical access or the ability to view the screen would be able to see the passwords as they are being entered, allowing them to later access accounts and services...
CVE-2016-1601
yast2-users before 3.1.47, as used in SUSE Linux Enterprise 12 SP1, does not properly set empty password fields in /etc/shadow during an AutoYaST installation when the profile does not contain inst-sys users, which might allow attackers to have unspecified impact via unknown vectors...
SUSE-SU-2016:1138-1 Security update for yast2-users
yast2-users was updated to fix one security issue. This security issue was fixed: - CVE-2016-1601: Empty passwords fields in /etc/shadow after SLES 12 SP1 autoyast installation bsc974220. This update includes a script that fixes installations that we're affected by this problem. It is run...
CVE-2009-4872
Multiple SQL injection vulnerabilities in globepersonnellogin.asp in Logoshows BBS 2.0 allow remote attackers to execute arbitrary SQL commands via the 1 username and 2 password fields...
CVE-2008-0286: Improper Neutralization of Special Elements used in an SQL Command
SQL injection vulnerability in admin/login.php in Article Dashboard allows remote attackers to execute arbitrary SQL commands via the 1 user or 2 password fields...
Irola My-Time 3.5 Remote SQL Injection Vulnerability
No description provided by source. Aria-Security Team http://Aria-Security.Net ----------------------------- Original Advisory @ http://aria-security.net/forum/showthread.php?p=1106 Vendor: http://www.irola.com Username/Password Fields can run SQL Queries. Therefore: We get the Tables:...