flatCore CMS 1.4.6: Remote Code Execution and Easteregg

RIPS Analysis The 74,000 lines of code of the flatCore CMS were analyzed in less than 3 minutes. RIPS discovered multiple vulnerabilities ranging from open redirection CVE-2017-11205 and cross-site scripting CVE-2017-11204 to SQL injection CVE-2017-11207, many of them being exploitable as...

Legal Robot: Weak Cryptography for Passwords

Hi Team, I saw while creating new account.Password is being encrypted that's good best practice. But Issue is: 1. It is showing in the request What type of encryptionAlgorithm is used in request. 2. I copied the encrypted password and past it online tool http://md5decrypt.net/en/Sha256/ and i was...

CVE-2017-11133: Use of a Broken or Risky Cryptographic Algorithm

An issue was discovered in heinekingmedia StashCat through 1.7.5 for Android, through 0.0.80w for Web, and through 0.0.86 for Desktop. To encrypt messages, AES in CBC mode is used with a pseudo-random secret. This secret and the IV are generated with math.random in previous versions and with...

CVE-2017-1224

IBM Tivoli Endpoint Manager uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 123903...

CVE-2017-1224

IBM Tivoli Endpoint Manager uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 123903...

PT-2017-12420

Name of the Vulnerable Software and Affected Versions IBM Tivoli Endpoint Manager affected versions not specified Description The issue concerns the use of weaker than expected cryptographic algorithms, which could allow an attacker to decrypt highly sensitive information. Recommendations At the...

CVE-2017-7673: Improper Restriction of Excessive Authentication Attempts

Apache OpenMeetings 1.0.0 uses not very strong cryptographic storage, captcha is not used in registration and forget password dialogs and auth forms missing brute force protection...

CVE-2017-7673

Apache OpenMeetings 1.0.0 uses not very strong cryptographic storage, captcha is not used in registration and forget password dialogs and auth forms missing brute force protection...

Command injection

A Weak Cryptography for Passwords issue was discovered in General Electric GE Multilin SR 750 Feeder Protection Relay, firmware versions prior to Version 7.47; SR 760 Feeder Protection Relay, firmware versions prior to Version 7.47; SR 469 Motor Protection Relay, firmware versions prior to Versio...

CVE-2017-7905

A Weak Cryptography for Passwords issue was discovered in General Electric GE Multilin SR 750 Feeder Protection Relay, firmware versions prior to Version 7.47; SR 760 Feeder Protection Relay, firmware versions prior to Version 7.47; SR 469 Motor Protection Relay, firmware versions prior to Versio...

CVE-2017-7905: Weak Encoding for Password

A Weak Cryptography for Passwords issue was discovered in General Electric GE Multilin SR 750 Feeder Protection Relay, firmware versions prior to Version 7.47; SR 760 Feeder Protection Relay, firmware versions prior to Version 7.47; SR 469 Motor Protection Relay, firmware versions prior to Versio...

PT-2017-17984

Name of the Vulnerable Software and Affected Versions General Electric GE Multilin SR 750 Feeder Protection Relay versions prior to 7.47 General Electric GE Multilin SR 760 Feeder Protection Relay versions prior to 7.47 General Electric GE Multilin SR 469 Motor Protection Relay versions prior to...

PT-2017-12245

Name of the Vulnerable Software and Affected Versions IBM BigFix Compliance Analytics version 1.9.79 Description The issue is related to the use of weaker than expected cryptographic algorithms, which could allow an attacker to decrypt highly sensitive information. Recommendations For IBM BigFix...

CVE-2016-3099: Use of a Broken or Risky Cryptographic Algorithm

modns in Red Hat Enterprise Linux Desktop 7, Red Hat Enterprise Linux HPC Node 7, Red Hat Enterprise Linux Server 7, and Red Hat Enterprise Linux Workstation 7 allows remote attackers to force the use of ciphers that were not intended to be enabled...

CVE-2016-3019

IBM Security Access Manager for Web 9.0.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 114462...

CVE-2016-3019

IBM Security Access Manager for Web 9.0.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 114462...

PT-2017-8298

Name of the Vulnerable Software and Affected Versions IBM Security Access Manager for Web version 9.0.0 Description The issue is related to the use of weaker than expected cryptographic algorithms, which could allow an attacker to decrypt highly sensitive information. Recommendations For IBM...

Starbucks: Unable to register in starbucks app

Unable to register in starbucks India app due to weak crypography of passwords...

PT-2017-3791

Name of the Vulnerable Software and Affected Versions Moxa EDS-G516E Series versions 5.2 and earlier Moxa EDS-510E affected versions not specified Description The issue is related to the use of a weak cryptographic algorithm in the firmware of the affected products. This weakness may allow an...

GE Multilin SR, UR, and URplus Protective Relays (Update A)

CVSS v3 8.1 ATTENTION: Remotely exploitable/low skill level to exploit. Vendor: GE Equipment: Multilin SR, UR, and URplus Protective Relays Vulnerabilities: Weak Cryptography for Passwords UPDATED INFORMATION This updated advisory is a follow-up to the original advisory titled ICSA-17-117-01 GE...