Default configuration

A vulnerability has been identified in Primary Setup Tool PST All versions V4.2 HF1, SIMATIC IT Production Suite All versions V7.0 SP1 HFX 2, SIMATIC NET PC-Software All versions V14, SIMATIC PCS 7 V7.1 All versions, SIMATIC PCS 7 V8.0 All versions, SIMATIC PCS 7 V8.1 All versions, SIMATIC PCS 7...

The vulnerability of the CODESYS Runtime Toolkit execution environment allows a perpetrator to execute arbitrary commands and load arbitrary files.

The vulnerability of the CODESYS Runtime Toolkit lies in the absence of requirements for authentication procedures in the default configuration. Exploiting this vulnerability allows a malicious actor to execute commands through the command line interface and upload arbitrary files...

SOL52439336 - FreeType vulnerabilities CVE-2014-9746 and CVE-2014-9747

Vulnerability Recommended Actions If you are running a version listed in the Versions known to be vulnerable column, you can eliminate this vulnerability by upgrading to a version listed in the Versions known to be not vulnerable column. If the table lists only an older version than what you are...

Unspecified Vulnerabilities in Multiple F5 Products

F5 BIG-IP is an all-in-one network device from F5 USA that integrates network traffic management, application security management, load balancing and other functions. A security vulnerability exists in the default configuration of the BIG-IP IPsec IKE peer listener in several F5 products, which c...

TikiWiki 15.1 ELFinder Unauthenticated File Upload

Description A file upload vulnerability in Tiki Wiki --Part83012510490351498898101-- 3. Info Author: Mehmet Ince https://www.exploit-db.com/exploits/40091/...

NUUO NVRmini 2 / NETGEAR ReadyNAS Surveillance Default Configuration Load and Administrator Password Reset

The NVRmini 2 Network Video Recorded and the ReadyNAS Surveillance application are vulnerable to an administrator password reset on the exposed web management interface. Note that this only works for unauthenticated attackers in earlier versions of the Nuuo firmware before v1.7.6, otherwise you...

F5 Networks BIG-IP : BIND vulnerability (K34250741)

db.c in named in ISC BIND 9.x before 9.9.8-P2 and 9.10.x before 9.10.3-P2 allows remote attackers to cause a denial of service REQUIRE assertion failure and daemon exit via a malformed class attribute. CVE-2015-8000 Impact An attack may cause a denial-of-service DoS on the vulnerable BIND system ...

CVE-2015-6316

The default configuration of sshdconfig in Cisco Mobility Services Engine MSE through 8.0.120.7 allows logins by the oracle account, which makes it easier for remote attackers to obtain access by entering this account's hardcoded password in an SSH session, aka Bug ID CSCuv40501...

Ubiquiti Networks Hardcoded Keys / Remote Management

SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Insecure default configuration product: various Ubiquiti Networks products vulnerable version: see Vulnerable / tested versions fixed version: none available impact: High...

Default configuration

The default configuration of the server in MobaXterm before 8.3 has a disabled Access Control setting and consequently does not require authentication for X11 connections, which allows remote attackers to execute arbitrary commands or obtain sensitive information via X11 packets...

Persistent Systems Accelerite Radia Client Automation Access Bypass Vulnerability

Persistent Systems Accelerite Radia Client Automation formerly known as HP Client Automation is a client automation management solution from Persistent Systems India. The solution provides monitoring, alerting, auto-remediation and reporting on hardware, applications and operating systems. A...

CVE-2015-7863

The default configuration of Persistent Accelerite Radia Client Automation formerly HP Client Automation 7.9 through 9.1 before 2015-02-19 enables a remote Notify capability without the Extended Notify Security features, which might allow remote attackers to bypass intended access restrictions vi...

Design/Logic Flaw

Algorithmic complexity vulnerability in Address.pm in the Email-Address module 1.908 and earlier for Perl allows remote attackers to cause a denial of service CPU consumption via a crafted string containing a list of e-mail addresses in conjunction with parenthesis characters that can be associat...

CVE-2015-7686

Algorithmic complexity vulnerability in Address.pm in the Email-Address module 1.908 and earlier for Perl allows remote attackers to cause a denial of service CPU consumption via a crafted string containing a list of e-mail addresses in conjunction with parenthesis characters that can be associat...

Mango Automation 2.6.0 Unprotected Debug Log View

Mango Automation 2.6.0 Unprotected Debug Log View Vulnerability Vendor: Infinite Automation Systems Inc. Product web page: http://www.infiniteautomation.com/ Affected version: 2.5.2 and 2.6.0 beta build 327 Summary: Mango Automation is a flexible SCADA, HMI And Automation software application tha...

Cisco Prime Network Registrar Privilege Escalation Vulnerability

A vulnerability in the default configuration of the Cisco Prime Network Registrar CPNR virtual appliance OVA which could allow an authenticated, local attacker to gain root privileges. The vulnerability is due to an insecure default account present on the affected device. A local attacker could...

WiFi Pineapple Predictable CSRF Token

Overview =============== WiFi Pineapples are a penetration testing tool used in offensive wireless activities. These devices run on a modified OpenWRT based on netBSD operating system. They include a web-based management interface. It has been discovered they have predictable anti-CSRF tokens bas...

sudo: unsafe handling of TZ environment variable

It was discovered that sudo did not perform any checks of the TZ environment variable value. If sudo was configured to preserve the TZ environment variable, a local user with privileges to execute commands via sudo could possibly use this flaw to achieve system state changes not permitted by the...

Apple MAC OS X Apache Server HTTP Authentication Bypass Vulnerability

Apple Mac OS X is a commercial operating system. Apple Mac OS X default Apache configuration does not contain the modhfsapple vulnerability, which allows remote attackers to exploit the vulnerability by submitting a special request to access HTTP authentication-protected directory information...

Debian DLA-239-1 : cups security update

Two critical vulnerabilities have been found in the CUPS printing system : CVE-2015-1158 - Improper Update of Reference Count Cupsd uses reference-counted strings with global scope. When parsing a print job request, cupsd over-decrements the reference count for a string from the request. As a...