CVE-2018-16669

The CVE-2018-16669 entry concerns CIRCONTROL’s Open Charge Point Protocol (OCPP) implementations used in CirCarLife, PowerStudio, and similar products. The issue arises from storing admin credentials in XML files, allowing an unprivileged user to read /services/config/config.xml and obtain OCPP/c...

CVE-2018-11086

Pivotal Usage Service in Pivotal Application Service, versions 2.0 prior to 2.0.21 and 2.1 prior to 2.1.13 and 2.2 prior to 2.2.5, contains a bug which may allow escalation of privileges. A space developer with access to the system org may be able to access an artifact which contains the CF admin...

OpenAFS has an unspecified vulnerability

OpenAFS is a distributed file system that allows sharing of archives and resources between systems over LANs and WANs. A security vulnerability exists in OpenAFS versions prior to 1.6.23 and 1.8.x prior to 1.8.2, which stems from the backup tape controller process not requiring authentication for...

CVE-2018-16947

OpenAFS has a concrete vulnerability set: CVE-2018-16947 affects OpenAFS before 1.6.23 and 1.8.x before 1.8.2, where the backup tape controller (butc) RPCs are not authenticated, enabling an unauthenticated attacker to perform volume operations with administrator credentials (e.g., dumping/restor...

CirCarLife SCADA 4.3.0 - Credential Disclosure

CirCarLife SCADA 4.3.0 - Credential Disclosure Exploit Title: CirCarLife SCADA 4.3.0 - Credential Disclosure Date: 2018-09-10 Exploit Author: David Castro Vendor Homepage: https://circontrol.com/ Shodan Dork: Server: CirCarLife Server: PsiOcppApp Version: CirCarLife Scada all versions under 4.3.0...

CirCarLife SCADA 4.3.0 - Credential Disclosure

Exploit Title: CirCarLife SCADA 4.3.0 - Credential Disclosure Date: 2018-09-10 Exploit Author: David Castro Vendor Homepage: https://circontrol.com/ Shodan Dork: Server: CirCarLife Server: PsiOcppApp Version: CirCarLife Scada all versions under 4.3.0 OCPP implementation all versions under 1.5.0 C...

CVE-2018-16604

An issue was discovered in Nibbleblog v4.0.5. With an admin's username and password, an attacker can execute arbitrary PHP code by changing the username because the username is surrounded by double quotes e.g., "$phpinfo"...

CVE-2017-16744

A path traversal vulnerability in Tridium Niagara AX Versions 3.8 and prior and Niagara 4 systems Versions 4.4 and prior installed on Microsoft Windows Systems can be exploited by leveraging valid platform administrator credentials...

Zoho ManageEngine Applications Manager SQL Injection Vulnerability (CNVD-2018-15179)

ZOHO ManageEngine Applications Manager is a set of IT operation and maintenance management solutions of the United States ZhuoHao ZOHO company. The product has application performance management, fault management, report generation and SLA management and other functions. A SQL injection...

Dicoogle PACS 2.5.0 Directory Traversal

Exploit Title: Dicoogle PACS 2.5.0 - Directory Traversal Date: 2018-05-25 Software Link: http://www.dicoogle.com/home Version: Dicoogle PACS 2.5.0-201712291522 Category: webapps Tested on: Windows 2012 R2 Exploit Author: Carlos Avila Contact: http://twitter.com/badboynt 1. Description Dicoogle is...

Timehop Breach Impacts Personal Data of 21 Million Users

The personal data of millions of Timehop customers has been compromised after a hacker gained access to its cloud-based backend computing environment. Timehop, a service that plugs into users’ social media platforms and shows them memories from the past, disclosed the data breach on Sunday. The...

Foscam Foscam Camera Command Injection Vulnerability

FOSCAM, the safe life brand of Shenzhen FOSCAM Intelligent Technology Co., Ltd, covers network video surveillance products network cameras, hard disk recorders, surveillance kits, video cloud storage services and so on. Foscam Foscam Camera suffers from a command injection vulnerability, which...

CVE-2018-11527

CVE-2018-11527 affects CScms v4.1, where a Cross-site request forgery (CSRF) in plugins/sys/admin/Sys.php allows remote attackers to change the administrator’s username and password via /admin.php/sys/editpass_save. Exploitation details are not provided beyond the path, but the vulnerability enab...

CVE-2018-0222

A vulnerability in Cisco Digital Network Architecture DNA Center could allow an unauthenticated, remote attacker to log in to an affected system by using an administrative account that has default, static user credentials. The vulnerability is due to the presence of undocumented, static user...

CVE-2018-0277

A vulnerability in the Extensible Authentication Protocol-Transport Layer Security EAP-TLS certificate validation during EAP authentication for the Cisco Identity Services Engine ISE could allow an unauthenticated, remote attacker to cause the ISE application server to restart unexpectedly, causi...

Moxa EDR-810 Password Plaintext Transfer Vulnerability

The EDR-810 is a highly integrated industrial multi-port security router with firewall/NAT/VPN and two-layer manageable switch functionality. A password cleartext transfer vulnerability exists in the Web server and Telnet functionality of the Moxa EDR-810 V4.1 build 17030317. An attacker can...

Foxconn FEMTO AP-FC4064-T Weak Password Vulnerability

The Foxconn FEMTO AP-FC4064-T is a home base station device from Foxconn. A security vulnerability exists in the web administration page of the Foxconn FEMTO AP-FC4064-T APGTB385.8.3lb15-W47 LTE Build 15 version, which stems from the admin account using a weak default password: admin, and the...

CVE-2017-12123

An exploitable clear text transmission of password vulnerability exists in the web server and telnet functionality of Moxa EDR-810 V4.1 build 17030317. An attacker can look at network traffic to get the admin password for the device. The attacker can then use the credentials to login as admin...

CVE-2017-12123

An exploitable clear text transmission of password vulnerability exists in the web server and telnet functionality of Moxa EDR-810 V4.1 build 17030317. An attacker can look at network traffic to get the admin password for the device. The attacker can then use the credentials to login as admin...

PT-2018-5364 · Moxa · Moxa Edr-810

Name of the Vulnerable Software and Affected Versions: Moxa EDR-810 version 4.1 build 17030317 Description: A clear text transmission of password issue exists in the web server and telnet functionality. An attacker can intercept network traffic to obtain the admin password for the device, and the...