CVE-2017-2162

The CVE-2017-2162 entry affects Toshiba FlashAir SDHC memory cards (SD-WE Series <W-03; V3.00.02 and earlier) and (SD-WD/WC Series

Default credentials

jasypt before 1.9.2 allows a timing attack against the password hash comparison...

FlashAir SDHC Memory Card Information Disclosure Vulnerability

FlashAir SDHC Memory Card is an SD memory card from Toshiba, Japan. A security vulnerability exists in the FlashAir SDHC Memory Card. A remote attacker could use default credentials to obtain image data...

C.H.I.P. Device Default Credentials (SSH)

The remote C.H.I.P. device is using known default credentials. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

BruteSpray - Brute-Forcing from Nmap output (Automatically attempts default creds on found services)

BruteSpray takes nmap GNMAP output and automatically brute-forces services with default credentials using Medusa. BruteSpray can even find non-standard ports by using the -sV inside Nmap. Usage First do an nmap scan with '-oA nmap.gnmap'. Command: python brutespray.py -h Example: python...

FlashAir do not set credential information in PhotoShare

Overview FlashAir by Toshiba Corporation is an SDHC memory card which provides wireless LAN access functions. FlashAir PhotoShare function enables to share the image data in a certain folder with other users as it switches the original wireless LAN connection set by FlashAir default to the wirele...

Default credentials

360fly 4K cameras allow unauthenticated Wi-Fi password changes and complete access with REST by using the Bluetooth Low Energy pairing procedure, which is available at any time and does not require a password. This affects firmware 2.1.4. Exploitation can use the 360fly Android or iOS application...

Default credentials

Craft CMS before 2.6.2976 does not prevent modification of the URL in a forgot-password email message...

BSA-2017-239

Security Advisory ID : BSA-2017-239 Component : SNMP Revision : 1.0: Interim The Simple Network Management Protocol SNMP is a commonly used network service. Its primary function is to provide network administrators with information about all kinds of network connected devices. SNMP can be used to...

Default credentials

kedpm 0.5 and 1.0 creates a history file in /.kedpm/history that is written in cleartext. All of the commands performed in the password manager are written there. This can lead to the disclosure of the master password if the "password" command is used with an argument. The names of the password...

Default credentials

vsftpd on TP-Link C2 and C20i devices through firmware 0.9.1 4.2 v0032.0 Build 160706 Rel.37961n has a backdoor admin account with the 1234 password, a backdoor guest account with the guest password, and a backdoor test account with the test password...

Default credentials

D-Link DVG-N5402SP with firmware W1000CN-00, W1000CN-03, or W2000EN-00 has a default password of root for the root account and tw for the tw account, which makes it easier for remote attackers to obtain administrative access...

Default credentials

Netgear WNAP320, WNDAP350, and WNDAP360 before 3.5.5.0 reveal wireless passwords and administrative usernames and passwords over SNMP...

Default credentials

oVirt Engine before 4.0.3 does not include DWHDBPASSWORD in the list of keys to hide in log files, which allows local users to obtain sensitive password information by reading engine log files...

Beware! Dozens of Linksys Wi-Fi Router Models Vulnerable to Multiple Flaws

Bad news for consumers with Linksys routers: Cybersecurity researchers have disclosed the existence of nearly a dozen of unpatched security flaws in Linksys routers, affecting 25 different Linksys Smart Wi-Fi Routers models widely used today. IOActive's senior security consultant Tao Sauvage and...

GlobaLeaks: Information Disclosure

I have observed that the application is leaking information while accessing "https://demo.globaleaks.org/l10n/en". It does not restrict access to file, which can possibly provide an attacker with information such as default credentials test:test, username for accessing administrative functions,...

Default credentials

An attacker that has hijacked a Unitrends Enterprise Backup before 9.1.2 web server session can leverage api/includes/users.php to change the password of the logged in account without knowing the current password. This allows for an account takeover...

Default credentials

In SolarWinds Log & Event Manager LEM before 6.3.1 Hotfix 4, a menu system is encountered when the SSH service is accessed with "cmc" and "password" the default username and password. By exploiting a vulnerability in the restrictssh feature of the menuing script, an attacker can escape from the...

Cisco Mobility Express Software Default Credential Security Bypass Vulnerability

Cisco Mobility Express Software is a wireless networking solution. A security vulnerability exists in the implementation of Cisco Mobility Express Software that Cisco Aironet 1830 Series, Cisco Aironet 1850 Series Access Points devices are running due to default credentials. An unauthenticated...

Default credentials

In KeePassX before 0.4.4, a cleartext copy of password data is created upon a cancel of an XML export action. This allows context-dependent attackers to obtain sensitive information by reading the .xml dotfile...