389-ds-base: information disclosure through 'cn=changelog' subtree

An information disclosure flaw was found in the way the 389 Directory Server stored information in the Changelog that is exposed via the 'cn=changelog' LDAP sub-tree. An unauthenticated user could in certain cases use this flaw to read data from the Changelog, which could include sensitive...

389-ds-base: information disclosure through 'cn=changelog' subtree

An information disclosure flaw was found in the way the 389 Directory Server stored information in the Changelog that is exposed via the 'cn=changelog' LDAP sub-tree. An unauthenticated user could in certain cases use this flaw to read data from the Changelog, which could include sensitive...

powerpc-utils: snap creates archives with fstab and yaboot.conf which may expose certain passwords

A flaw was found in the way the snap utility of powerpc-utils generated an archive containing a configuration snapshot of a service. A local attacker could obtain sensitive information from the generated archive such as plain text passwords...

Mojang Resets Users' Passwords, Microsoft Insists Not a Hack

Microsoft confirmed this week that one of its recent acquisitions, the gaming firm Mojang, has not been hacked. Nearly 2,000 credentials belonging to users of the Mojang game Minecraft – email addresses and passwords in plain-text – surfaced on Pastebin earlier this week and speculation began to...

EAP6: Plain text password logging during security audit

It was found that the security audit functionality logged request parameters in plain text. This may have caused passwords to be included in the audit log files when using BASIC or FORM-based authentication. A local attacker with access to audit log files could possibly use this flaw to obtain...

VDG Security SENSE 2.3.13 File Disclosure / Bypass / Buffer Overflow

SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Multiple critical vulnerabilities product: VDG Security SENSE formerly DIVA vulnerable version: 2.3.13 fixed version: unknown - no vendor confirmation impact: critical...

EAP6: Plain text password logging during security audit

It was found that the security audit functionality logged request parameters in plain text. This may have caused passwords to be included in the audit log files when using BASIC or FORM-based authentication. A local attacker with access to audit log files could possibly use this flaw to obtain...

Yik Yak Patches Privacy Flaw in iOS App

Yik Yak, an application that allows users to share purportedly anonymous status updates with others near them, has fixed a critical vulnerability in its iOS app that could have de-anonymized users and let attackers take total control of someone’s account. Yik Yak’s security team was apparently...

Advertise With Pleasure! (AWP) 6.6 SQL Injection

Exploit Title: Advertise With Pleasure! AWP = 6.6 - SQL Injection vulnerability Date: 12/02/2014 Author: Robert Cooper robertcatareyousecure.net Software Link: http://www.guruperl.net/products/awppro/ Tested on: Linux/Windows 7 Vulnerable Parameter: groupid= PoC:...

Advertise With Pleasure! (AWP) 6.6 - SQL Injection

Exploit Title: Advertise With Pleasure! AWP = 6.6 - SQL Injection vulnerability Date: 12/02/2014 Author: Robert Cooper robertcatareyousecure.net Software Link: http://www.guruperl.net/products/awppro/ Tested on: Linux/Windows 7 Vulnerable Parameter: groupid= PoC:...

RHEL 6 : rhevm-dwh 3.3.3 (RHSA-2014:0559)

An updated rhevm-dwh package that fixes one security issue and two bugs is now available. The Red Hat Security Response Team has rated this update as having Low security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available from the CV...

RHEL 6 : JBoss EWP (RHSA-2013:0195)

Updated JBoss Enterprise Web Platform 5.2.0 packages that fix multiple security issues, various bugs, and add several enhancements are now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability...

RHEL 6 : rhevm-reports 3.3.3 (RHSA-2014:0558)

An updated rhevm-reports package that fixes three security issues and one bug is now available. The Red Hat Security Response Team has rated this update as having Low security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed severity ratings, are available for eac...

Web Auditing Framework: GoLismero

GoLismero is an open source framework for security testing. It’s currently geared towards web security, but it can easily be expanded to other kinds of scans. Features: Real platform independence. Tested on Windows, Linux, BSD and OS X. No native library dependencies. All of the framework has bee...

Information disclosure

McAfee Network Data Loss Prevention NDLP before 9.3 allows local users to obtain sensitive information and affect integrity via vectors related to a "plain text password."...

CVE-2014-8527

McAfee Network Data Loss Prevention NDLP before 9.3 allows local users to obtain sensitive information and affect integrity via vectors related to a "plain text password."...

Stash email settings fields can be inadvertently be populated by browser with user login details - security issue

The email and username password in the email server settings screen has the same names as the username and password fields when logging in. This has the unintentional side affect of being pre-populated by your browser if you have left the mail server credentials blank and your browser has saved...

F5 Networks BIG-IP : CRIME vulnerability via TLS 1.2 protocol (K14054)

The TLS protocol 1.2 and earlier, as used in Mozilla Firefox, Google Chrome, and other products, can encrypt compressed data without properly obfuscating the length of the unencrypted data. This allows man-in-the-middle attackers to obtain plain text HTTP headers by observing length differences...

EAP6: Plain text password logging during security audit

It was found that the security audit functionality logged request parameters in plain text. This may have caused passwords to be included in the audit log files when using BASIC or FORM-based authentication. A local attacker with access to audit log files could possibly use this flaw to obtain...

EAP6: Plain text password logging during security audit

It was found that the security audit functionality logged request parameters in plain text. This may have caused passwords to be included in the audit log files when using BASIC or FORM-based authentication. A local attacker with access to audit log files could possibly use this flaw to obtain...