Nuuo Central Management Server Authenticated Arbitrary File Upload

The COMMITCONFIG verb is used by a CMS client to upload and modify the configuration of the CMS Server. The vulnerability is in the "FileName" parameter, which accepts directory traversal ..\..\ characters. Therefore, this function can be abused to overwrite any files in the installation drive of...

Default credentials

Premisys Identicard version 3.1.190 database uses default credentials. Users are unable to change the credentials without vendor intervention...

Default credentials

Premisys Identicard version 3.1.190 stores user credentials and other sensitive information with a known weak encryption method MD5 hash of a salt and password...

CVE-2019-3909

Premisys Identicard version 3.1.190 database uses default credentials. Users are unable to change the credentials without vendor intervention...

CVE-2019-3909

Premisys Identicard version 3.1.190 database uses default credentials. Users are unable to change the credentials without vendor intervention...

CVE-2019-3909

Premisys Identicard version 3.1.190 database uses default credentials. Users are unable to change the credentials without vendor intervention...

CVE-2019-3909

CVE-2019-3909 affects Premisys Identicard PremiSys 3.1.190 database, where hard-coded/default credentials exist and cannot be changed without vendor intervention. The vulnerability permits an attacker to gain full access to the database and related admin functionality, with remediation not yet av...

Brickcom Network Camera Default Credentials (HTTP)

The remote Brickcom IP camera is using known default credentials for the HTTP login. Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This...

Default credentials

An issue was discovered in DouCo DouPHP 1.5 20181221. admin/nav.php?rec=update has XSS via the navname parameter...

Interlogix TruVision Default Credentials (HTTP)

The remote installation of TruVision is using known default credentials. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Orange Livebox Router Default Credentials (HTTP)

The remote installation of Orange Livebox is using known default credentials. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Default credentials

NEC Univerge Sv9100 WebPro 6.00.00 devices have Cleartext Password Storage in the Web UI...

Arecont Vision NVR Default Credentials (HTTP)

The remote installation of Arecont Vision SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptoid"1.3.6.1.4.1.25623.1.0.114051"...

Default credentials

Orange Livebox 00.96.320S devices allow remote attackers to discover Wi-Fi credentials via /getgetnetworkconf.cgi on port 8080, leading to full control if the admin password equals the Wi-Fi password or has the default admin value. This is related to Firmware 01.11.2017-11:43:44, Boot v0.70.03,...

Default credentials

An issue was discovered in D-Link 'myDlink Baby App' version 2.04.06. Whenever actions are performed from the app e.g., change camera settings or play lullabies, it communicates directly with the Wi-Fi camera D-Link 825L firmware 1.08 with the credentials username and password in base64 cleartext...

Default credentials

Missing password verification in the web interface on Gigaset Maxwell Basic VoIP phones with firmware 2.22.7 would allow a remote attacker in the same network as the device to change the admin password without authentication and without knowing the original password...

Huawei Router Flaw Leaks Default Credential Status

A vulnerability in some Huawei routers used for carrier ISP services allows cybercriminals to identify whether the devices have default credentials or not – without ever connecting to them. CVE-2018-7900 exists in the router panel and allows credentials information to leak – so attackers can simp...

Default credentials

IBM Security Guardium 10.0, 10.0.1, 10.1, 10.1.2, 10.1.3, 10.1.4, and 10.5 Database Activity Monitor does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. IBM X-Force ID: 132610...

Ubiquiti Networks Unifi Video Default Credentials (HTTP)

The remote installation of Unifi Video is using known default credentials. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Default credentials

In WordPress before 4.9.9 and 5.x before 5.0.1, the user-activation page could be read by a search engine's web crawler if an unusual configuration were chosen. The search engine could then index and display a user's e-mail address and rarely the password that was generated by default...