Default credentials

Swann SWWHD-INTCAM-HD devices have the twipc root password, leading to FTP access as root. NOTE: all affected customers were migrated by 2020-08-31...

CVE-2017-18381

The installation process in Open edX before 2017-01-10 exposes a MongoDB instance to external connections with default credentials...

CVE-2017-18381

The installation process in Open edX before 2017-01-10 exposes a MongoDB instance to external connections with default credentials...

Default credentials

The installation process in Open edX before 2017-01-10 exposes a MongoDB instance to external connections with default credentials...

CVE-2017-18381

The installation process in Open edX before 2017-01-10 exposes a MongoDB instance to external connections with default credentials...

CVE-2017-18381

CVE-2017-18381 concerns Open edX installations prior to 2017-01-10, where the installation process exposed a MongoDB instance to external connections using default credentials. This creates a risk of unauthorized access to the database. The connected Red Hat and other vulnerability records corrob...

Default credentials

An issue was discovered that affects the following versions of Rancher: v2.0.0 through v2.0.13, v2.1.0 through v2.1.8, and v2.2.0 through 2.2.1. When Rancher starts for the first time, it creates a default admin user with a well-known password. After initial setup, the Rancher administrator may...

PT-2019-8316 · Edx +1 · Open Edx +1

Name of the Vulnerable Software and Affected Versions: Open edX versions prior to 2017-01-10 Description: The installation process exposes a MongoDB instance to external connections with default credentials. This issue may allow unauthorized access to the database. Recommendations: For versions...

Default credentials

EspoCRM 5.6.4 is vulnerable to user password hash enumeration. A malicious authenticated attacker can brute-force a user password hash by 1 symbol at a time using specially crafted api/v1/User?filterList filters...

AKUVOX NETWORKS R50P VoIP phone Trust Management Issue Vulnerability

AKUVOX NETWORKS R50P VoIP phone is an IP phone from AKUVOX NETWORKS, China. A trust management issue vulnerability exists in AKUVOX NETWORKS R50P VoIP phone version 50.0.6.156, which arises from the lack of an effective trust management mechanism in a networked system or product, and can be...

Multiple AudioCodes Products Trust Management Issue Vulnerabilities

AudioCodes Mediant 500L-MSBR and so on are products of AudioCodes Israel.AudioCodes Mediant 500L-MSBR is a 500L series all-in-one SOHO/SMB router.AudioCodes Mediant 500-MSBR is a 500 The AudioCodes Mediant 500-MSBR is a 500L series all-in-one SOHO/SMB router. A trust management issue vulnerabilit...

Default credentials

The user password via the registration form of TronLink Wallet 2.2.0 is stored in the log when the class CreateWalletTwoActivity is called. Other authenticated users can read it in the log later. The logged data can be read using Logcat on the device. When using platforms prior to Android 4.1 Jel...

Default credentials

The Send Anywhere application 9.4.18 for Android stores confidential information insecurely on the system i.e., in cleartext, which allows a non-root user to find out the username/password of a valid user via /data/data/com.estmob.android.sendanywhere/sharedprefs/sendanywheredevice.xml...

Ahsay Backup v7.x-v8.1.1.50 (authenticated) file upload

This module exploits an authenticated insecure file upload and code execution flaw in Ahsay Backup v7.x - v8.1.1.50. To succesfully execute the upload credentials are needed, default on Ahsay Backup trial accounts are enabled so an account can be created. It can be exploited in Windows and Linux...

Default credentials

An issue was discovered in GLPI before 9.4.1. After a successful password reset by a user, it is possible to change that user's password again during the next 24 hours without any information except the associated email address...

Default credentials

In WESEEK GROWI before 3.5.0, a remote attacker can obtain the password hash of the creator of a page by leveraging wiki access to make API calls for page metadata. In other words, the password hash can be retrieved even though it is not a publicly available field...

Odoo Trust Management Issues Vulnerabilities

Odoo is an Enterprise Resource Planning ERP and Customer Relationship Management CRM system from Odoo Belgium. The system is developed in Python language, PostgreSQL as the database, and includes modules for sales management, inventory management, financial management and so on. A trust managemen...

CVE-2019-13379

On AVTECH Room Alert 3E devices before 2.2.5, an attacker with access to the device's web interface may escalate privileges from an unauthenticated user to administrator by performing a cmd.cgi?action=ResetDefaults&src=RA reset and using the default credentials to get in...

Default credentials

On AVTECH Room Alert 3E devices before 2.2.5, an attacker with access to the device's web interface may escalate privileges from an unauthenticated user to administrator by performing a cmd.cgi?action=ResetDefaults&src=RA reset and using the default credentials to get in...

CVE-2019-13379

AVTECH Room Alert 3E devices with firmware versions prior to 2.2.5 are vulnerable to privilege escalation. An attacker who can access the device’s web interface can escalate from an unauthenticated user to administrator by sending cmd.cgi?action=ResetDefaults&src=RA reset and then using default c...