336 matches found
PT-2023-29928
Name of the Vulnerable Software and Affected Versions authentik versions prior to 2023.8.4 and 2023.10.2 Description authentik is an open-source Identity Provider. When the default admin user has been deleted, it is potentially possible for an attacker to set the password of the default admin use...
Incorrect Authorization in User role
Description Incorrect Authorization in User role Proof of Concept 1 .Default, administrator User ID =1 cannot add user roles 2 .Remove the "disable" class at Inspect 3 .After that, add the user role success Video Poc https://drive.google.com/file/d/1vQPHZwaghByHsqEgQI9p3EiGeVCTbLK7/view?usp=shari...
CVE-2023-37755
i-doit pro 25 and below and I-doit open 25 and below are configured with insecure default administrator credentials, and there is no warning or prompt to ask users to change the default password and account name. Unauthenticated attackers can exploit this vulnerability to obtain Administrator...
CMS NEXIN 2.0 Insecure Settings
==================================================================================================================================== | Title : CMS NEXIN engine v2.0 Insecure Settings Vulnerability | | Author : indoushka | | Tested on : windows 10 Français V.Pro / browser : Mozilla firefox...
AMSS++ 2.0 Insecure Settings
==================================================================================================================================== | Title : AMSS++ v 2.0 Insecure Settings Vulnerability | | Author : indoushka | | Tested on : windows 10 Français V.Pro / browser : Mozilla firefox 65.032-bit | |...
CVE-2022-36222
Nokia Fastmile 3tg00118abad52 devices shipped by Optus are shipped with a default hardcoded admin account of admin:Nq+L5st7o This account can be used locally to access the web admin interface...
CVE-2022-45045
Multiple Xiongmai NVR devices, including MBD6304T V4.02.R11.00000117.10001.131900.00000 and NBD6808T-PL V4.02.R11.C7431119.12001.130000.00000, allow authenticated users to execute arbitrary commands as root, as exploited in the wild starting in approximately 2019. A remote and authenticated...
ManageEngine DataSecurity Plus Xnode Enumeration
This module exploits default admin credentials for the DataEngine Xnode server in DataSecurity Plus versions prior to 6.0.1 6011 in order to dump the contents of Xnode data repositories tables, which may contain a limited amount of Active Directory information including domain names, host names,...
Zebra ZTC Printer Web Interface Default Admin Password
The remote host has a web interface with a default administrative password. %NASLMINLEVEL 80900 C Tenable, Inc. include'compat.inc'; if description scriptid164505; scriptversion"1.1"; scriptsetattributeattribute:"pluginmodificationdate", value:"2022/08/30"; scriptnameenglish:"Zebra ZTC Printer We...
PT-2022-15952 · Softing · Edgeaggregator +2
Name of the Vulnerable Software and Affected Versions: Softing Secure Integration Server, edgeConnector, and edgeAggregator software affected versions not specified Description: The issue concerns the use of default administrator credentials, with the username as admin and the password as admin...
CVE-2021-42850
A weak default administrator password for the web interface and serial port was reported in some Lenovo Personal Cloud Storage devices that could allow unauthorized device access to an attacker with physical or local network access...
Verizon 4G LTE Network Extender 0.4.038.2131 Weak Credential Algorithm
Verizon 4G LTE Network Extender Weak Credentials Algorithm Vendor: Verizon Communications Inc. Product web page: https://www.verizon.com Affected version: GA4.38 - V0.4.038.2131 Summary: An LTE Network Extender enhances your indoor and 4G LTE data and voice coverage to provide better service for...
Verizon 4G LTE Network Extender Weak Credentials Algorithm
Summary An LTE Network Extender enhances your indoor and 4G LTE data and voice coverage to provide better service for your 4G LTE mobile devices. It's an extension of our 4G LTE network that's placed directly in your home or office. The LTE Network Extender works with all Verizon-sold 4G LTE mobi...
Exploit for Authentication Bypass by Spoofing in Apache Apisix
CVE-2022-24112-POC Apache APISIX 2.12.1 Rem...
Centralisation Risk: TokenManager Gives Unnecessary Permissions to The Default Admin Through changeDepositBoxAddress() Which May Cause The Bridge to Get Stuck
Lines of code Vulnerability details Impact The function changeDepositBoxAddress allows the DEFAULTADMINROLE to change the depositBox associated with a TokenManager. If the newDepositBox is incorrectly set either accidentally or maliciously it will cause the bridge to become stuck. For example if ...
CVE-2022-23320
XMPie uStore 12.3.7244.0 allows for administrators to generate reports based on raw SQL queries. Since the application ships with default administrative credentials, an attacker may authenticate into the application and exfiltrate sensitive information from the database...
CVE-2021-43284
An issue was discovered on Victure WR1200 devices through 1.0.3. The root SSH password never gets updated from its default value of admin. This enables an attacker to gain control of the device through SSH regardless of whether the admin password was changed on the web interface...
CVE-2021-28909
BAB TECHNOLOGIE GmbH eibPort V3 prior version 3.9.1 allow unauthenticated attackers to access uncontrolled the login service at /webif/SecurityModule in a brute force attack. The password could be weak and default username is known as 'admin'. This is usable and part of an attack chain to gain SS...
CVE-2020-25753
An issue was discovered on Enphase Envoy R3.x and D4.x devices with v3 software. The default admin password is set to the last 6 digits of the serial number. The serial number can be retrieved by an unauthenticated user at /info.xml...
CVE-2020-25753
An issue was discovered on Enphase Envoy R3.x and D4.x devices with v3 software. The default admin password is set to the last 6 digits of the serial number. The serial number can be retrieved by an unauthenticated user at /info.xml...