3452 matches found
Schneider Electric InduSoft Password Storage Vulnerability
InduSoft Web Studio is a SCADA system and embedded instrumentation solution for developing HMIs, supervisory control and data acquisition. Schneider Electric InduSoft Web Studio before 7.1.3.5 Patch 5 and Wonderware InTouch Machine Edition through 7.1 SP3 Patch 4 stores the passwords for the...
froxlor -- database password information leak
[email protected] reports: An unauthenticated remote attacker is able to get the database password via webaccess due to wrong file permissions of the /logs/ folder in froxlor version 0.9.33.1 and earlier. The plain SQL password and username may be stored in the /logs/sql-error.log file...
iBall 150M Wireless-N ADSL2+ Router Authentication Bypass Vulnerability
The CGI script used in the iBall 150M Wireless-N ADSL2+ router does not validate credentials. Hence any page in the router can be directly accessed by replacing page extension with .cgi. Exploit Title: iBall 150M Wireless-N ADSL2+ Router Authentication Bypass and Vulnerability Date: 23\04\2015...
iBall 150M Wireless-N ADSL2+ Router Authentication Bypass
Exploit Title: iBall 150M Wireless-N ADSL2+ Router Authentication Bypass and Vulnerability Date: 23\04\2015 Submitter: Gem George Vendor: iBall Tested product:iBall 150M Wireless-N ADSL2+ Router, firmware version 1.00 Tested Product URL:...
Cisco Nexus 9000 Series Software Password Exposure Vulnerability
A vulnerability in Cisco Nexus 9000 Series Software could allow an authenticated, remote attacker to expose passwords in plain text format. The vulnerability is due to older versions of the affected software retaining the ability to decrypt passwords. An attacker could exploit this vulnerability ...
Cisco Unified MeetingPlace Plain Text Password Information Disclosure Vulnerability
A vulnerability in Cisco Unified MeetingPlace could allow an authenticated, remote attacker to view passwords in plain text. The vulnerability is due to the inclusion of sensitive information in the web page source code of the affected software. An attacker could exploit this vulnerability to vie...
RLE Nova-Wind Turbine HMI Insecure Credentials Vulnerability
The Nova-Wind Turbine HMI is the human-machine interface for wind turbines. The Nova-Wind Turbine HMI stores credentials in plain document files, which can allow a malicious user to access the equipment, obtain sensitive information, and change the configuration...
Marktplaats: Content Spoofing - http://aanbieding.marktplaats.nl/wp-admin/admin-ajax.php
Hello, Content spoofing, also referred to as content injection or virtual defacement, is an attack targeting a user made possible by injection vulnerability in a web application. When an application does not properly handle user supplied data, an attacker can supply content to a web application,...
Grindr v2.1.1 iOS & Account System - Breach Attack
Document Title: =============== Grindr v2.1.1 iOS & Account System - Breach Attack References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1420 Release Date: ============= 2015-05-02 Vulnerability Laboratory ID VL-ID: ==================================== 1420...
Hospira MedNet Hardcoded Password Vulnerability (CNVD-2015-02160)
MedNet manages drug libraries, firmware updates, and configurations for Hospira IV pumps for use in the healthcare and public health sectors. MedNet uses plain text stored passwords for the SQL database, which allows an attacker to compromise the MedNet SQL server and gain administrator access to...
[SECURITY] Fedora 22 Update: dokuwiki-0-0.24.20140929c.fc22
DokuWiki is a standards compliant, simple to use Wiki, mainly aimed at crea ting documentation of any kind. It has a simple but powerful syntax which makes sure the datafiles remain readable outside the Wiki and eases the creation of structured texts. All data is stored in plain text files no...
[SECURITY] Fedora 21 Update: dokuwiki-0-0.24.20140929c.fc21
DokuWiki is a standards compliant, simple to use Wiki, mainly aimed at crea ting documentation of any kind. It has a simple but powerful syntax which makes sure the datafiles remain readable outside the Wiki and eases the creation of structured texts. All data is stored in plain text files no...
[SECURITY] Fedora 20 Update: dokuwiki-0-0.24.20140929c.fc20
DokuWiki is a standards compliant, simple to use Wiki, mainly aimed at crea ting documentation of any kind. It has a simple but powerful syntax which makes sure the datafiles remain readable outside the Wiki and eases the creation of structured texts. All data is stored in plain text files no...
MGASA-2015-0108 Updated 389-ds-base packages fix security vulnerabilities
An information disclosure flaw was found in the way the 389 Directory Server stored information in the Changelog that is exposed via the 'cn=changelog' LDAP sub-tree. An unauthenticated user could in certain cases use this flaw to read data from the Changelog, which could include sensitive...
389-ds-base: information disclosure through 'cn=changelog' subtree
An information disclosure flaw was found in the way the 389 Directory Server stored information in the Changelog that is exposed via the 'cn=changelog' LDAP sub-tree. An unauthenticated user could in certain cases use this flaw to read data from the Changelog, which could include sensitive...
389-ds-base: information disclosure through 'cn=changelog' subtree
An information disclosure flaw was found in the way the 389 Directory Server stored information in the Changelog that is exposed via the 'cn=changelog' LDAP sub-tree. An unauthenticated user could in certain cases use this flaw to read data from the Changelog, which could include sensitive...
powerpc-utils: snap creates archives with fstab and yaboot.conf which may expose certain passwords
A flaw was found in the way the snap utility of powerpc-utils generated an archive containing a configuration snapshot of a service. A local attacker could obtain sensitive information from the generated archive such as plain text passwords...
Plain Black WebGUI 'style-underground/search' cross-site scripting vulnerability
WebGUI is a CMS Content Management System software that is mainly used to facilitate the publishing and maintenance of website content. A cross-site scripting vulnerability exists in Plain Black WebGUI 'style-underground/search'. This allows remote attackers to execute arbitrary web script or HTM...
CVE-2015-1564
Cross-site scripting XSS vulnerability in style-underground/search in Plain Black WebGUI 7.10.29 and earlier allows remote attackers to inject arbitrary web script or HTML via the Search field...
CVE-2015-1564
Cross-site scripting XSS vulnerability in style-underground/search in Plain Black WebGUI 7.10.29 and earlier allows remote attackers to inject arbitrary web script or HTML via the Search field...