OPENSUSE-SU-2021:0930-1 Security update for freeradius-server

This update for freeradius-server fixes the following issues: - Fixed plaintext password entries in logfiles bsc1184016. This update was imported from the SUSE:SLE-15-SP2:Update update project...

Security update for freeradius-server (moderate)

openSUSE Security Update: Security update for freeradius-server Announcement ID: openSUSE-SU-2021:0930-1 Rating: moderate References: 1184016 Affected Products: openSUSE Leap 15.2 An update that contains security fixes can now be installed. Description: This update for freeradius-server fixes the...

FreeBSD : dovecot -- multiple vulnerabilities (d18f431d-d360-11eb-a32c-00a0989e4ec1)

Dovecot team reports : CVE-2021-29157: Dovecot does not correctly escape kid and azp fields in JWT tokens. This may be used to supply attacker controlled keys to validate tokens in some configurations. This requires attacker to be able to write files to local disk. CVE-2021-33515: On-path attacke...

SUSE: Security Advisory (SUSE-SU-2021:2147-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

PT-2021-6020 · Libgcrypt +9 · Libgcrypt +9

Name of the Vulnerable Software and Affected Versions: Libgcrypt versions prior to 1.9.4 Description: The issue is related to the use of a weak cryptographic algorithm in the Libgcrypt library. It affects the ElGamal implementation, allowing plaintext recovery due to a dangerous combination of th...

Trojan-Dropper.Win32.Juntador.a Weak Hardcoded Password

Discovery / credits: Malvuln - malvuln.com c 2021 Original source: https://malvuln.com/advisory/f28e866ce2f99013a66b015f6a7f31a8.txt Contact: [email protected] Media: twitter.com/malvuln Threat: Trojan-Dropper.Win32.Juntador.a Vulnerability: Weak Hardcoded Password Description: The malware...

Command Injection

dovecot is vulnerable to command injection. On-path attacker could inject plaintext commands before STARTTLS negotiation that would be executed after STARTTLS finished with the client. Only the SMTP submission service is affected...

SUSE-SU-2021:2147-1 Security update for freeradius-server

This update for freeradius-server fixes the following issues: - Fixed plaintext password entries in logfiles bsc1184016...

CVE-2021-33515

It was found that dovecot could still accept plaintext commands while the STARTTLS negotiation process is ongoing. This could allow an active person in the middle, with valid credentials on dovecot, to, for example, steal confidential data such as the client's emails and passwords...

Internet Bug Bounty: Fragmentation and Aggregation Flaws in Wi-Fi

I discovered three design flaws in the Wi-Fi standard and widespread related implementation flaws see GitHub overview and test tool. Here I'll specifically cover open source software. These findings have not received bug bounties from other sources. Implementation flaws allowing trivial packet...

CVE-2021-27487

ZOLL Defibrillator Dashboard, v prior to 2.2, The affected products contain credentials stored in plaintext. This could allow an attacker to gain access to sensitive information...

CVE-2021-27487

ZOLL Defibrillator Dashboard, v prior to 2.2, The affected products contain credentials stored in plaintext. This could allow an attacker to gain access to sensitive information...

CVE-2021-27487

ZOLL Defibrillator Dashboard, v prior to 2.2, The affected products contain credentials stored in plaintext. This could allow an attacker to gain access to sensitive information...

Information disclosure

ZOLL Defibrillator Dashboard, v prior to 2.2, The affected products contain credentials stored in plaintext. This could allow an attacker to gain access to sensitive information...

CVE-2021-27487

The connected ICS advisory confirms CVE-2021-27487 affects ZOLL Defibrillator Dashboard, with the vulnerability CWE-312: Cleartext Storage of Sensitive Information. Affected product/version: Defibrillator Dashboard versions prior to 2.2. Root cause: credentials stored in plaintext within the appl...

VeryFitPro 加密问题漏洞

VeryFitPro is a powerful health management software from China's Shenzhen Aidu Technology Co., Ltd. that needs to be used with the same brand of smart bracelet, using the app users can view the number of steps taken, calories burned, sleep quality and other information in real time. There is an...

SUSE: Security Advisory (SUSE-SU-2021:1959-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Solar-Log 500 2.8.2 - Unprotected Storage of Credentials Vulnerability

Exploit Title: Solar-Log 500 2.8.2 - Unprotected Storage of Credentials Google Dork: In Shodan search engine, the filter is ""Server: email protected"" Exploit Author: Luca.Chiou Vendor Homepage: https://www.solar-log.com/en/ Software Link: Firmware for Solar-Log...

Solar-Log 500 2.8.2 - Unprotected Storage of Credentials

Exploit Title: Solar-Log 500 2.8.2 - Unprotected Storage of Credentials Google Dork: In Shodan search engine, the filter is ""Server: IPC@CHIP"" Date: 2021-06-11 Exploit Author: Luca.Chiou Vendor Homepage: https://www.solar-log.com/en/ Software Link: Firmware for Solar-Log...

Solar-Log 500 2.8.2 Password Disclosure

Exploit Title: Solar-Log 500 2.8.2 - Unprotected Storage of Credentials Google Dork: In Shodan search engine, the filter is ""Server: IPC@CHIP"" Date: 2021-06-11 Exploit Author: Luca.Chiou Vendor Homepage: https://www.solar-log.com/en/ Software Link: Firmware for Solar-Log...