Arbitrary Password Reset Vulnerability in eCar Insurance App

eCar Insurance is a mobile internet car insurance software application platform developed by Chengdu Zhongtong Technology Co. There is an arbitrary password reset vulnerability in eCar Insurance APP, which can be exploited by an attacker to change any user's password...

CVE-2019-9123

An issue was discovered on D-Link DIR-825 Rev.B 2.10 devices. The "user" account has a blank password...

PT-2019-6345 · D Link · D-Link Dir-825

Name of the Vulnerable Software and Affected Versions: D-Link DIR-825 versions 2.10 Description: The issue is related to the use of weak password requirements in the D-Link DIR-825 router's firmware. This can allow a remote attacker to impact the confidentiality, integrity, and availability of...

Mozilla Firefox < 62.0 Multiple Vulnerabilities

Binary data 700407.prm...

Sensitive Information Leakage

The sos package has a sensitive information leakage vulnerability. During archival of debugging information, the package does not remove the root user password information stored in the Kickstart configuration file /root/anaconda-ks.cfg it leaves the root user password information from the...

Privilege Escalation

craftcms/cms is vulnerable to privilege escalation. The vulnerability exists because it does not validate the original user's password and expects impersonated user's password...

CVE-2018-20193

Certain Secure Access SA Series SSL VPN products originally developed by Juniper Networks but now sold and supported by Pulse Secure, LLC allow privilege escalation, as demonstrated by Secure Access SSL VPN SA-4000 5.1R5 build 9627 4.2 Release build 7631. This occurs because appropriate controls...

Moxa ThingsPro Information Disclosure Vulnerability

Moxa ThingsPro is a suite of IoT gateway and device management solutions from Moxa. A security vulnerability exists in Moxa ThingsPro version 2.1. A remote attacker can exploit this vulnerability by performing a brute force attack to obtain the password of a valid user...

GuangWei GuangWei Honda APPv2.1 has information leakage vulnerability

GuangWei GAC Honda APP is an APP that provides car owners with remote control of their cars, one-click car inspection, GPS positioning, violation information query, fuel consumption analysis, convenient merchant interaction, quick query of car information and other functions. A vulnerability exis...

designer.diealbenmanufaktur.de XSS vulnerability

Open Bug Bounty ID: OBB-670717 Description| Value ---|--- Affected Website:| designer.diealbenmanufaktur.de Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

CVE-2018-1000633

The vulnerability CVE-2018-1000633 affects Open Microscopy Environment OMERO.web prior to version 5.4.7. It exposes user passwords through log files created during login and password-change forms, enabling an attacker to read web server logs and potentially log in as the affected user. The issue ...

CVE-2016-6546 iTrack Easy mobile application stores the user password in base-64 encoding/cleartext

The iTrack Easy mobile application stores the account password used to authenticate to the cloud API in base64-encoding in the cache.db file. The base64 encoding format is considered equivalent to cleartext...

Cross site request forgery (csrf)

/upload/catalog/controller/account/password.php in OpenCart through 3.0.2.0 has CSRF via the index.php?route=account/password URI to change a user's password...

HP Enterprise VAN SDN Controller 2.7.18.0503 Remote Root

KL-001-2018-008 : HPE VAN SDN Unauthenticated Remote Root Vulnerability Title: HPE VAN SDN Unauthenticated Remote Root Vulnerability Advisory ID: KL-001-2018-008 Publication Date: 2018.06.25 Publication URL: https://korelogic.com/Resources/Advisories/KL-001-2018-008.txt 1. Vulnerability Details...

Design/Logic Flaw

The Olive Tree Ftp Server application 1.32 for Android has a "Sensitive Data on the Clipboard" vulnerability, as demonstrated by reading the "User password" field with the Drozer post.capture.clipboard module...

CVE-2018-12481

The Olive Tree Ftp Server application 1.32 for Android has a "Sensitive Data on the Clipboard" vulnerability, as demonstrated by reading the "User password" field with the Drozer post.capture.clipboard module...

CVE-2018-11134

In order to perform actions that requires higher privileges, the Quest KACE System Management Appliance 8.0.318 relies on a message queue managed that runs with root privileges and only allows a set of commands. One of the available commands allows changing any user's password including root. A...

CVE-2018-1148

In Nessus before 7.1.0, Session Fixation exists due to insufficient session management within the application. An authenticated attacker could maintain system access due to session fixation after a user password change...

CVE-2018-1148

In Nessus before 7.1.0, Session Fixation exists due to insufficient session management within the application. An authenticated attacker could maintain system access due to session fixation after a user password change...

Rooting a Logitech Harmony Hub: Improving Security in Today's IoT World

Introduction FireEye’s Mandiant Red Team recently discovered vulnerabilities present on the Logitech Harmony Hub Internet of Things IoT device that could potentially be exploited, resulting in root access to the device via SSH. The Harmony Hub is a home control system designed to connect to and...