2222 matches found
Ipswitch MOVEit DMZ 8.1 Information Disclosure
Profundis Labs - Security Advisory Vulnerablity Title ================== Enumeration of existing usernames Vendor: ======= Ipswitch, Inc http://www.ipswitchft.com Product: ======== MOVEit File Transfer MOVEit is an automated file transfer system that lets you manage, view, secure, and control all...
CVE-2015-7248
ZTE ZXHN H108N R1A devices before ZTE.bhs.ZXHNH108NR1A.kPE allow remote attackers to discover usernames and password hashes by reading the cgi-bin/webproc HTML source code, a different vulnerability than CVE-2015-8703...
Joomla MyDynGallery SQL Injection
Joomla! commydyngallery Automatic SQL Injection exploit multiple ways Author: D35m0nd142 Google Dork: inurl:"index.php?option=commydyngallery" Date: 12/12/2015 Vulns found by R3d.W0rm & H3ll-dz Software link: https://www.joomla.org Tested on: all Joomla! versions containing component mydyngallery...
Design/Logic Flaw
The Echo extension for MediWiki does not properly implement the hideuser functionality, which allows remote authenticated users to see hidden usernames in "non-revision based" notifications, as demonstrated by viewing a hidden username in a Thanks notification...
Telnet 弱口令 PoC
常见的用户名： admin, root, administrator, user, test 常用密码： 123456, admin, password, root, test...
Joomla Real Estate Manager Component Error-Based SQL Injection
This module exploits a SQL injection vulnerability in Joomla Plugin comrealestatemanager versions 3.7 in order to either enumerate usernames and password hashes. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class...
Joomla com_contenthistory Error-Based SQL Injection
This module exploits a SQL injection vulnerability in Joomla versions 3.2 through 3.4.4 in order to either enumerate usernames and password hashes. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModul...
Automatically Brute Force All Services – BruteX
Automatically brute force all services Including: Open ports DNS domains Web files Web directories Usernames Passwords Dependencies: NMap Hydra Wfuzz SNMPWalk DNSDict Download: git clone https://github.com/1N3/BruteX.git Usage: ./brutex target To brute force multiple hosts, use brutex-massscan an...
CVE-2015-5189
Race condition in pcsd in PCS 0.9.139 and earlier uses a global variable to validate usernames, which allows remote authenticated users to gain privileges by sending a command that is checked for security after another user is authenticated...
CVE-2015-6524
The LDAPLoginModule implementation in the Java Authentication and Authorization Service JAAS in Apache ActiveMQ 5.x before 5.10.1 allows wildcard operators in usernames, which allows remote attackers to obtain credentials via a brute force attack. NOTE: this identifier was SPLIT from CVE-2014-361...
DEBIAN-CVE-2015-6524
The LDAPLoginModule implementation in the Java Authentication and Authorization Service JAAS in Apache ActiveMQ 5.x before 5.10.1 allows wildcard operators in usernames, which allows remote attackers to obtain credentials via a brute force attack. NOTE: this identifier was SPLIT from CVE-2014-361...
CVE-2015-3238
The unixrunhelperbinary function in the pamunix module in Linux-PAM aka pam before 1.2.1, when unable to directly access passwords, allows local users to enumerate usernames or cause a denial of service hang via a large password...
CVE-2015-6524
The LDAPLoginModule implementation in the Java Authentication and Authorization Service JAAS in Apache ActiveMQ 5.x before 5.10.1 allows wildcard operators in usernames, which allows remote attackers to obtain credentials via a brute force attack. NOTE: this identifier was SPLIT from CVE-2014-361...
UBUNTU-CVE-2015-6524
The LDAPLoginModule implementation in the Java Authentication and Authorization Service JAAS in Apache ActiveMQ 5.x before 5.10.1 allows wildcard operators in usernames, which allows remote attackers to obtain credentials via a brute force attack. NOTE: this identifier was SPLIT from CVE-2014-361...
Cisco Prime Infrastructure Elevation of Privilege Vulnerability
Cisco Prime Infrastructure is a wireless management solution through Cisco Prime LAN Management Solution and Cisco Prime Network Control System technologies. A security vulnerability exists in Cisco Prime Infrastructure, as the program stores case-sensitive usernames and performs case-sensitive...
REST API Vulnerability in Multiple F5 BIG-IQ Products
The BIG-IQ Cloud Platform provides the core services necessary for the management of application-oriented services. A security vulnerability exists in the REST API of multiple F5 BIG-IQ products, which can be exploited by a remote attacker to obtain an authentication token for any user by guessin...
Cloudminr Bitcoin Hack Exposes Data on 80,000
Attackers were able to break into servers belonging to Bitcoin cloud-mining platform Cloudminr.io last week and harvest the site’s entire database. Now hackers are attempting to sell the information, which includes thousands of unencrypted usernames, email addresses, and passwords. Cloudminr, a...
Cisco WebEx Meeting Center Web-Based Administrative Interface User Enumeration Vulnerability
A vulnerability in the web-based administrative interface of Cisco WebEx Meeting Center could allow an unauthenticated, remote attacker to enumerate valid usernames and determine if the usernames have administrative privileges. The vulnerability is due to a logic error in the handling of invalid...
BruteX - Automatically Brute Force all Services Running on a Target
Automatically brute force all services running on a target including: Open ports DNS domains Web files Web directories Usernames Passwords USAGE ./brutex target DEPENDENCIES NMap Hydra Wfuzz SNMPWalk DNSDict To brute force multiple hosts, use brutex-massscan and include the IP's/hostnames to scan...
rest-client ruby gem logs sensitive information
REST client for Ruby aka rest-client before 1.7.3 logs usernames and passwords, which allows local users to obtain sensitive information by reading the log...