PT-2016-7387

Name of the Vulnerable Software and Affected Versions Fortinet FortiWLC versions 6.1-2-29 and earlier Fortinet FortiWLC version 7.0-9-1 Fortinet FortiWLC version 7.0-10-0 Fortinet FortiWLC version 8.0-5-0 Fortinet FortiWLC version 8.1-2-0 Fortinet FortiWLC version 8.2-4-0 Description The issue...

Cisco Unified Computing System Command Line Interface Privilege Escalation Vulnerability

A vulnerability in the command-line interface CLI of the Cisco Unified Computing System UCS Manager and UCS 6200 Series Fabric Interconnects could allow an authenticated, local attacker to access the underlying operating system with the privileges of the root user. The vulnerability is due to...

MuM Map Edit 3.2.6.0 SQL Injection / File Manipulation / Poor Practices

Security Advisory -- Multiple Vulnerabilities - MuM Map Edit Product Vendor: Mensch und Maschine Software SE / Mensch und Maschine acadGraph GmbH Product: MapEdit Affected software version: 3.2.6.0 MuM MapEdit provides geodata to the internet and intranets and is deployed on several communal and...

Forticlient ™ end-SSLVPN 5.4 - credentials information disclosure

No description provided by source. from winappdbg import Debug, Process, HexDump import sys filename = "FortiTray.exe" 程序名 searchstring = "fortissl" 当用户凭证存储在进程内存中，模仿偏移 查询用户凭证函数 def memorysearch pid, strings : process = Process pid memdump =...

Information Disclosure Vulnerability in Hitachi Automation Director and JP1/Automatic Operation

Overview An Information Disclosure Vulnerability was found in Hitachi Automation Director and JP1/Automatic Operation. Impact Remote attackers might exploit this vulnerability to obtain user credentials. Solution Please refer to the 'Vendor Information' section for the official countermeasure and...

LocalTapiola: Open redirection protection bypass (/cs/Satellite)

Issue The reporter found a vulnerability that allowed open and unvalidated redirects. Fix A fix was issued for the application. Reasoning "Unvalidated redirects and forwards are possible when a web application accepts untrusted input that could cause the web application to redirect the request to...

LocalTapiola: Oracle WebCenter Sites Support Tools available and Information disclosure (/cs/Satellite)

Oracle WebCenter Sites Support Tools are available in: www.lahitapiola.fi This software is password protected, but some pages are publicly available and reveal internal information. The welcome page is located at: http://www.lahitapiola.fi/henkilo?pagename=Support/Home This page reveal data as th...

newsp.eu PHP Calendar Script 1.0 - User Credentials Disclosure

Exploit Title: PHP calendar script Password Download File Date: 2016-07-18 Exploit Author: Meisam Monsef [email protected] or [email protected] Vendor Homepage: http://www.newsp.eu/calendarscript.php?pt=st Version: All Version Download Link : http://www.newsp.eu/calendar.zip Exploit :...

NewsP Free News Script 1.4.7 - User Credentials Disclosure

Exploit Title: Free News Script User Password Download File Date: 2016-07-18 Exploit Author: Meisam Monsef [email protected] or [email protected] Vendor Homepage: http://www.newsp.eu/index.php?pt=ns Version: All Version Download Link : http://www.newsp.eu/newsp.zip Exploit :...

NewsP Free News Script 1.4.7 - User Credentials Disclosure

Exploit for php platform in category web applications Exploit Title: Free News Script User Password Download File Date: 2016-07-18 Exploit Author: Meisam Monsef email protected or email protected Vendor Homepage: http://www.newsp.eu/index.php?pt=ns Version: All Version Download Link :...

NewsP Free News Script 1.4.7 - User Credentials Disclosure

NewsP Free News Script 1.4.7 - User Credentials Disclosure Exploit Title: Free News Script User Password Download File Date: 2016-07-18 Exploit Author: Meisam Monsef [email protected] or [email protected] Vendor Homepage: http://www.newsp.eu/index.php?pt=ns Version: All Version Download Link ...

PHP Calendar Script 1.0 - User Credentials Disclosure

Exploit for php platform in category web applications Exploit Title: PHP calendar script Password Download File Date: 2016-07-18 Exploit Author: Meisam Monsef email protected or email protected Vendor Homepage: http://www.newsp.eu/calendarscript.php?pt=st Version: All Version Download Link :...

newsp.eu PHP Calendar Script 1.0 - User Credentials Disclosure

newsp.eu PHP Calendar Script 1.0 - User Credentials Disclosure Exploit Title: PHP calendar script Password Download File Date: 2016-07-18 Exploit Author: Meisam Monsef [email protected] or [email protected] Vendor Homepage: http://www.newsp.eu/calendarscript.php?pt=st Version: All Version...

Researchers Crack Furtim, SFG Malware Connection

New research is challenging what security researchers know about Furtim, a new malware strain that has been compared to Stuxnet because of its believed targeting of industrial controls in energy companies. According to security experts at Damballa, Furtim and the recently discovered SFG malware a...

Seeking Alpha Mobile Financial App Forgoes Encryption

A popular mobile application that provides financial market research material operates without a measure of encryption, putting user information, including credentials and strategic financial interests at risk. The Seeking Alpha mobile app for Android and iOS also leaks everything from HTTP cooki...

WSO2 SOA Enablement Server Server Side Request Forgery

Title: WSO2 SOA Enablement Server - Server Side Request Forgery Authors: Pawel Gocyla Date: 10. June 2016 Affected Software: ================== WSO2 SOA Enablement Server for Java/6.6 build SSJ-6.6-20090827-1616 Probably other versions are also vulnerable. Vulnerability: Server Side Request Forge...

Datadog Forces Password Reset Following Breach

Datadog, a software-as-a service-based provider of IT infrastructure monitoring and analytics services, has forced a password reset on all of its user and admin accounts following a breach last Friday. “We have detected unauthorized activity associated with a handful of production infrastructure...

The vulnerability of the Serv-U File Server allows a remote attacker to obtain information about the system’s configuration and user authentication credentials.

The vulnerability of the Serv-U File Server software relates to errors that occur during the processing of application variables. Exploiting this vulnerability allows a malicious attacker to obtain system configuration information, including user authentication data...

Data Breaches Feed Password Reuse Crimes: No Simple Fixes

It was June 2012 when Dale Meredith was shopping online for a BBQ grill for Father’s Day and found one at Sears.com. The only snag, he had to create a username and password to buy it. That irked him. He was annoyed because it was literally the hundredth-plus service—including his local newspaper,...

500K Members of Hacking Forum Doxxed

An underground forum called Nulled.io that helped users share stolen credentials, software cracks, and leaked content was hacked earlier this month, spilling a glut of information, including users’ email addresses, encrypted passwords, and IP addresses, among other details. According to researche...