2868 matches found
Cisco Unified MeetingPlace Plain Text Password Information Disclosure Vulnerability
A vulnerability in Cisco Unified MeetingPlace could allow an authenticated, remote attacker to view passwords in plain text. The vulnerability is due to the inclusion of sensitive information in the web page source code of the affected software. An attacker could exploit this vulnerability to vie...
Marktplaats: Content Spoofing - http://aanbieding.marktplaats.nl/wp-admin/admin-ajax.php
Hello, Content spoofing, also referred to as content injection or virtual defacement, is an attack targeting a user made possible by injection vulnerability in a web application. When an application does not properly handle user supplied data, an attacker can supply content to a web application,...
Grindr v2.1.1 iOS & Account System - Breach Attack
Document Title: =============== Grindr v2.1.1 iOS & Account System - Breach Attack References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1420 Release Date: ============= 2015-05-02 Vulnerability Laboratory ID VL-ID: ==================================== 1420...
Hospira MedNet Hardcoded Password Vulnerability (CNVD-2015-02160)
MedNet manages drug libraries, firmware updates, and configurations for Hospira IV pumps for use in the healthcare and public health sectors. MedNet uses plain text stored passwords for the SQL database, which allows an attacker to compromise the MedNet SQL server and gain administrator access to...
[SECURITY] Fedora 22 Update: dokuwiki-0-0.24.20140929c.fc22
DokuWiki is a standards compliant, simple to use Wiki, mainly aimed at crea ting documentation of any kind. It has a simple but powerful syntax which makes sure the datafiles remain readable outside the Wiki and eases the creation of structured texts. All data is stored in plain text files no...
[SECURITY] Fedora 21 Update: dokuwiki-0-0.24.20140929c.fc21
DokuWiki is a standards compliant, simple to use Wiki, mainly aimed at crea ting documentation of any kind. It has a simple but powerful syntax which makes sure the datafiles remain readable outside the Wiki and eases the creation of structured texts. All data is stored in plain text files no...
[SECURITY] Fedora 20 Update: dokuwiki-0-0.24.20140929c.fc20
DokuWiki is a standards compliant, simple to use Wiki, mainly aimed at crea ting documentation of any kind. It has a simple but powerful syntax which makes sure the datafiles remain readable outside the Wiki and eases the creation of structured texts. All data is stored in plain text files no...
MGASA-2015-0108 Updated 389-ds-base packages fix security vulnerabilities
An information disclosure flaw was found in the way the 389 Directory Server stored information in the Changelog that is exposed via the 'cn=changelog' LDAP sub-tree. An unauthenticated user could in certain cases use this flaw to read data from the Changelog, which could include sensitive...
389-ds-base: information disclosure through 'cn=changelog' subtree
An information disclosure flaw was found in the way the 389 Directory Server stored information in the Changelog that is exposed via the 'cn=changelog' LDAP sub-tree. An unauthenticated user could in certain cases use this flaw to read data from the Changelog, which could include sensitive...
389-ds-base: information disclosure through 'cn=changelog' subtree
An information disclosure flaw was found in the way the 389 Directory Server stored information in the Changelog that is exposed via the 'cn=changelog' LDAP sub-tree. An unauthenticated user could in certain cases use this flaw to read data from the Changelog, which could include sensitive...
powerpc-utils: snap creates archives with fstab and yaboot.conf which may expose certain passwords
A flaw was found in the way the snap utility of powerpc-utils generated an archive containing a configuration snapshot of a service. A local attacker could obtain sensitive information from the generated archive such as plain text passwords...
Mojang Resets Users' Passwords, Microsoft Insists Not a Hack
Microsoft confirmed this week that one of its recent acquisitions, the gaming firm Mojang, has not been hacked. Nearly 2,000 credentials belonging to users of the Mojang game Minecraft – email addresses and passwords in plain-text – surfaced on Pastebin earlier this week and speculation began to...
EAP6: Plain text password logging during security audit
It was found that the security audit functionality logged request parameters in plain text. This may have caused passwords to be included in the audit log files when using BASIC or FORM-based authentication. A local attacker with access to audit log files could possibly use this flaw to obtain...
VDG Security SENSE 2.3.13 File Disclosure / Bypass / Buffer Overflow
SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Multiple critical vulnerabilities product: VDG Security SENSE formerly DIVA vulnerable version: 2.3.13 fixed version: unknown - no vendor confirmation impact: critical...
EAP6: Plain text password logging during security audit
It was found that the security audit functionality logged request parameters in plain text. This may have caused passwords to be included in the audit log files when using BASIC or FORM-based authentication. A local attacker with access to audit log files could possibly use this flaw to obtain...
Yik Yak Patches Privacy Flaw in iOS App
Yik Yak, an application that allows users to share purportedly anonymous status updates with others near them, has fixed a critical vulnerability in its iOS app that could have de-anonymized users and let attackers take total control of someone’s account. Yik Yak’s security team was apparently...
Advertise With Pleasure! (AWP) 6.6 SQL Injection
Exploit Title: Advertise With Pleasure! AWP = 6.6 - SQL Injection vulnerability Date: 12/02/2014 Author: Robert Cooper robertcatareyousecure.net Software Link: http://www.guruperl.net/products/awppro/ Tested on: Linux/Windows 7 Vulnerable Parameter: groupid= PoC:...
Advertise With Pleasure! (AWP) 6.6 - SQL Injection
Exploit Title: Advertise With Pleasure! AWP = 6.6 - SQL Injection vulnerability Date: 12/02/2014 Author: Robert Cooper robertcatareyousecure.net Software Link: http://www.guruperl.net/products/awppro/ Tested on: Linux/Windows 7 Vulnerable Parameter: groupid= PoC:...
RHEL 6 : rhevm-reports 3.3.3 (RHSA-2014:0558)
An updated rhevm-reports package that fixes three security issues and one bug is now available. The Red Hat Security Response Team has rated this update as having Low security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed severity ratings, are available for eac...
RHEL 6 : rhevm-dwh 3.3.3 (RHSA-2014:0559)
An updated rhevm-dwh package that fixes one security issue and two bugs is now available. The Red Hat Security Response Team has rated this update as having Low security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available from the CV...