(0Day) Hewlett Packard Enterprise Intelligent Management Center MyFaces Static Key ViewState Use of Default Credentials Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Hewlett Packard Enterprise Intelligent Management Center. Authentication is not required to exploit this vulnerability. The specific flaw exists within the configuration of the product. The web...

Aruba VAN SDN default credentials

The Aruba Virtual Application Networks VAN Software Defined Networking SDN controller running on the remote host is configured with default credentials. A default service token is configured or the 'sdn' account is using a default password. An unauthenticated, remote attacker can exploit this to...

Default credentials

Checkstyle before 8.18 loads external DTDs by default...

BSides SF 2019: Remote-Root Bug in Logitech Harmony Hub Patched and Explained

SAN FRANCISCO – Users of Logitech’s Harmony Hub have been wide open to an attack for years because of four unpatched vulnerabilities that left any IoT device connected at risk to remote takeover. The bugs were patched by Logitech in November, but for the first time the researchers that discovered...

TP-Link Megapixel Surveillance Camera Default Credentials (HTTP)

The remote installation of TP-Link Copyright C 2019 Greenbone Networks GmbH SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either...

D-Link DIR-825 Default Credentials (HTTP)

D-Link DIR-825 devices use an empty default password for the accounts SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Default credentials

An issue was discovered on D-Link DIR-878 1.12B01 devices. At the /HNAP1 URI, an attacker can log in with a blank password...

Default credentials

An issue was discovered on D-Link DIR-825 Rev.B 2.10 devices. The "user" account has a blank password...

Nuuo Central Management SQL Injection Exploit

The Nuuo Central Management Server allows an authenticated user to query the state of the alarms. This functionality can be abused to inject SQL into the query. As SQL Server 2005 Express is installed by default, xpcmdshell can be enabled and abused to achieve code execution. This module will...

Default credentials

data/interfaces/default/history.html in Tautulli 2.1.26 has XSS via a crafted Plex username that is mishandled when constructing the History page...

Default credentials

VNote 2.2 has XSS via a new text note...

Beward IP Camera Default Credentials / Unprotected Web Access (HTTP)

The remote installation of Beward Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribute it...

Default credentials

controller/fetchpwd.php and controller/doAction.php in HotelsServer through 2018-11-05 rely on base64 in an attempt to protect password storage...

Default credentials

An issue was discovered in gsi-openssh-server 7.9p1 on Fedora 29. If PermitPAMUserChange is set to yes in the /etc/gsissh/sshdconfig file, logins succeed with a valid username and an incorrect password, even though a failure entry is recorded in the /var/log/messages file...

Planet IP Camera Default Credentials (HTTP)

The remote installation of Planet Copyright C 2019 Greenbone Networks GmbH SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either versi...

Samsung iPolis Default Credentials (HTTP)

The remote installation of Samsung iPolis is using known default credentials. Copyright C 2019 Greenbone Networks GmbH SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published b...

Avtech IP Camera Default Credentials (HTTP)

The remote installation of Avtech SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptoid"1.3.6.1.4.1.25623.1.0.114064";...

MayGion IPCamera Default Credentials (HTTP)

The remote MayGion IP camera is using known default credentials for the HTTP login. Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This...

Japan to Hunt Down Citizens' Insecure IoT Devices

The Japanese government is taking the problem of insecure IoT devices into its own hands, with what some say is an audacious plan to carry out wide-scale penetration testing on its citizens’ gadgets. The country’s National Institute of Information and Communications Technology NICT has been taske...

VMware ESX / ESXi Web-Based Datastore Browser Default Credentials

Nessus was able to log in to the remote VMware ESX / ESXi Web-Based Datastore Browser using a default set of administrative credentials. A remote attacker could utilize these credentials to access virtual machine and virtual disk files. C Tenable Network Security, Inc. include"compat.inc"; if...