OpenJDK: exposure of server authentication credentials to proxy (Networking, 8160838)

A flaw was found in the way the Networking component of OpenJDK handled HTTP proxy authentication. A Java application could possibly expose HTTPS server authentication credentials via a plain text network connection to an HTTP proxy if proxy asked for authentication...

OpenJDK: exposure of server authentication credentials to proxy (Networking, 8160838)

A flaw was found in the way the Networking component of OpenJDK handled HTTP proxy authentication. A Java application could possibly expose HTTPS server authentication credentials via a plain text network connection to an HTTP proxy if proxy asked for authentication...

openSUSE Security Update : kcoreaddons (openSUSE-2016-1200)

This update for kcoreaddons fixes the following issues : - CVE-2016-7966: HTML injection in plain text viewer boo1002977 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Update openSUSE-2016-1200. The...

ovirt-engine: ovirt-engine-provisiondb logs contain DB username and password in plain text

It was found that the ovirt-engine-provisiondb utility did not correctly sanitize the authentication details used with the “—provisiondb” options from the output before storing them in log files. This could allow an attacker with read access to these log files to obtain sensitive information such...

WinSMS 3.43 Local Privilege Escalation

Exploit Title: WinSMS 3.43 Local Privilege Escalation Date: 13/09/2016 Exploit Author: Tulpa Contact: [email protected] Author website: www.tulpa-security.com Vendor Homepage: http://www.winsms.co.za Software Link: https://www.winsms.co.za/products/bulk-sms-desktop-software/ Version:...

How to Hack Smart Bluetooth Locks and IoT Devices — Check this Out

Bluetooth Low Energy, also known as Bluetooth Smart or Bluetooth 4, is the leading protocol designed for connecting IoT devices, medical equipment, smart homes and like most emerging technologies, security is often an afterthought. As devices become more and more embedded in our daily lives,...

WinSMS 3.43 - Insecure File Permissions Privilege Escalation Exploit

Exploit for windows platform in category local exploits Exploit Title: WinSMS 3.43 Local Privilege Escalation Date: 13/09/2016 Exploit Author: Tulpa Contact: email protected Author website: www.tulpa-security.com Vendor Homepage: http://www.winsms.co.za Software Link:...

WinSMS 3.43 - Insecure File Permissions Privilege Escalation

WinSMS 3.43 - Insecure File Permissions Privilege Escalation Exploit Title: WinSMS 3.43 Local Privilege Escalation Date: 13/09/2016 Exploit Author: Tulpa Contact: [email protected] Author website: www.tulpa-security.com Vendor Homepage: http://www.winsms.co.za Software Link:...

WinSMS 3.43 - Insecure File Permissions Privilege Escalation

Exploit Title: WinSMS 3.43 Local Privilege Escalation Date: 13/09/2016 Exploit Author: Tulpa Contact: [email protected] Author website: www.tulpa-security.com Vendor Homepage: http://www.winsms.co.za Software Link: https://www.winsms.co.za/products/bulk-sms-desktop-software/ Version:...

Apple iCloud Desktop Client 5.2.1.0 - Local Credentials Disclosure

Apple iCloud Desktop Client 5.2.1.0 - Local Credentials Disclosure Apple iCloud Desktop Client v5.2.1.0 Local Credentials Disclosure After Sign Out Exploit Tested on Windows Windows 7 64bit, English Vendor Homepage @ https://www.apple.com/ Product Homepage @ https://support.apple.com/en-us/HT2042...

TeamViewer 11.0.65452 (x64) - Local Credentials Disclosure

Exploit for windows platform in category local exploits TeamViewer 11.0.65452 64 bit Local Credentials Disclosure Tested on Windows 7 64bit, English Vendor Homepage @ https://www.teamviewer.com/ Date 07/09/2016 Bug Discovered by Alexander Korznikov https://www.linkedin.com/in/nopernik...

WIN-911 7.17.00 - Multiple Vulnerabilities

Exploit for windows platform in category local exploits Title: WIN-911 - Insecure File Permissions EoP CWE Class: CWE-276: Incorrect Default Permissions Date: 05/09/2016 Vendor: Win911 Product: WIN-911 Type: Alarm Notification Software Version: V7.17.00 Download URL: through Rockwell Automation...

WIN-911 7.17.00 - Multiple Vulnerabilities

Title: WIN-911 - Insecure File Permissions EoP CWE Class: CWE-276: Incorrect Default Permissions Date: 05/09/2016 Vendor: Win911 Product: WIN-911 Type: Alarm Notification Software Version: V7.17.00 Download URL: through Rockwell Automation downloads:...

ZYCOO IP Phone System Remote Command Execution

Vulnerable hardware : ZYCOO IP phone system Vendor : zycoo.com Author : Ahmed sultan @0x4148 Email : [email protected] Summary : According to the vendor's site , CooVox Series IP Phone System is the most innovative solution for VoIP telecommunication in SMB Small and Medium-sized Business market...

ZYCOO IP Phone System - Remote Command Execution

Exploit for cgi platform in category web applications Vulnerable hardware : ZYCOO IP phone system Vendor : zycoo.com Author : Ahmed sultan @0x4148 Email : email protected Summary : According to the vendor's site , CooVox Series IP Phone System is the most innovative solution for VoIP...

SonarQube Jenkins Password Disclosure

Advisory Information Title: SonarQube Jenkins Plugin - Plain Text Password Date published: 2013-12-05 Date of last update: 2013-12-05 Vendors contacted : SonarQube and Jenkins CI Discovered by: Christian Catalano Severity: High 2. Vulnerability Information CVE reference: CVE-2013-5676 CVSS v2...

Mimikittenz - Post-Exploitation Powershell Tool for Extracting Juicy info from Memory

mimikittenz is a post-exploitation powershell tool that utilizes the Windows function ReadProcessMemory in order to extract plain-text passwords from various target processes. mimikittenz can also easily extract other kinds of juicy info from target processes using regex patterns including but no...

Domain penetration--Dump Clear-Text Password after KB2871997 installed-vulnerability warning-the black bar safety net

In penetration testing, the penetration tester will typically use mimikatz from the LSA of the memory to export system's plaintext password, while experienced administrators will often choose to install the patch kb2871997 to limit this behavior. This one relates to what are the interesting...

VK.com HACKED! 100 Million Clear Text Passwords Leaked Online

Another day, another Data Breach! Now, Russia's biggest social networking site VK.com is the latest in the line of historical data breaches targeting social networking websites. The same hacker who previously sold data dumps from MySpace, Tumblr, LinkedIn, and Fling.com, is now selling more than...

Apache Qpid Java Broker Denial of Service Vulnerability

Apache Qpid Java Broker is the United States Apache Apache Software Foundation developed a use of the Java language written for routing and forwarding mail message middleware. A security vulnerability exists in Apache Qpid Java Broker. When the PLAIN mechanism is enabled in the program, an attack...