4279 matches found
Iranian APT Group ‘CyberAv3ngers’ Target U.S. Critical Infrastructure
Summary: CyberAv3ngers, an Iranian APT group affiliated with the IRGC, is known for cyberattacks against critical infrastructure, recently targeting U.S. Water and Wastewater Systems facilities. The group employs defacement tactics, exploiting default credentials in Unitronics PLCs, and expressin...
SUSE CVE-2023-30801
All versions of the qBittorrent client through 4.5.5 use default credentials when the web user interface is enabled. The administrator is not forced to change the default credentials. As of 4.5.5, this issue has not been fixed. A remote attacker can use the default credentials to authenticate and...
Fedora 39 : qbittorrent (2023-1bbfc445a2)
The remote Fedora 39 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-1bbfc445a2 advisory. - Update Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested for this issue but...
PT-2023-8242 · Siemens · Simatic Cn 4100
Name of the Vulnerable Software and Affected Versions: SIMATIC CN 4100 versions prior to V2.7 Description: A vulnerability has been identified in the intermediate installation process of the SIMATIC CN 4100 communication gateway, which is related to the use of default credentials with admin...
VulnCheck KEV: CVE-2017-8226
Amcrest IPM-721S V2.420.AC00.16.R.20160909 devices have default credentials that are hardcoded in the firmware and can be extracted by anyone who reverses the firmware to identify them. If the firmware version V2.420.AC00.16.R 9/9/2016 is dissected using binwalk tool, one obtains a...
Default credentials
In the module "CSV Feeds PRO" csvfeeds 2.6.1 from Bl Modules for PrestaShop, a guest can download personal information without restriction. Due to too permissive access control which does not force administrator to use password on feeds, a guest can access exports from the module which can lead t...
Mass-Bruter - Mass Bruteforce Network Protocols
Mass bruteforce network protocols Info Simple personal script to quickly mass bruteforce common services in a large scale of network. It will check for default credentials on ftp, ssh, mysql, mssql...etc. This was made for authorized red team penetration testing purpose only. How it works 1. Use...
U.S. Dept Of Defense: Default Admin Username and Password on ███
A vulnerability was found where default administrator credentials could be used to access an application. This could have allowed unauthorized access...
VulnCheck KEV: CVE-2021-35327
A vulnerability in TOTOLINK A720R A720RFirmware v4.1.5cu.470B20200911 allows attackers to start the Telnet service, then login with the default credentials via a crafted POST request...
Default credentials
DataHub is an open-source metadata platform. The HMAC signature for DataHub Frontend sessions was being signed using a SHA-1 HMAC with the frontend secret key. SHA1 with a 10 byte key can be brute forced using sufficient resources i.e. state level actors with large computational capabilities...
Default credentials
Affected devices allow to change the password, but insufficiently check which password is to be changed. With this an authenticated attacker could, under certain conditions, be able to change the password of another, potential admin user allowing her to escalate her privileges...
Default credentials
DataHub is an open-source metadata platform. In affected versions sign-up through an invite link does not properly restrict users from signing up as privileged accounts. If a user is given an email sign-up link they can potentially create an admin account given certain preconditions. If the defau...
EnBw SENEC Legacy Storage Box Default Credentials
Advisory ID: Ph0s-2023-004 Product: EnBw - SENEC legacy storage box: V1-V3 Manufacturer: SENEC - a part of EnBw Affected Versions: Firmware: all as of 2023-06-19 Tested Versions: current Vulnerability Type: CWE-1392: Use of Default Credentials Risk Level: CVSS v3.1 Vector:...
Default credentials
An issue discovered in Pfsense CE version 2.6.0 allows attackers to change the password of any user without verification...
Default credentials
ZITADEL provides identity infrastructure. ZITADEL provides administrators the possibility to define a Lockout Policy with a maximum amount of failed password check attempts. On every failed password check, the amount of failed checks is compared against the configured maximum. Exceeding the limit...
Default credentials
A vulnerability in IBM Robotic Process Automation and IBM Robotic Process Automation for Cloud Pak 21.0.0 through 21.0.7.10, 23.0.0 through 23.0.10 may result in access to client vault credentials. This difficult to exploit vulnerability could allow a low privileged attacker to programmatically...
Default credentials
Lost and Found Information System 1.0 allows account takeover via username and password to a /classes/Users.php?f=save URI...
Default credentials
bcrypt password hashing in Botan before 2.1.0 does not correctly handle passwords with a length between 57 and 72 characters, which makes it easier for attackers to determine the cleartext password...
Default credentials
In NFC, there is a possible way to setup a default contactless payment app without user consent due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...