Default credentials

The conversion utility for converting CiscoWorks Wireless LAN Solution Engine WLSE 4.1.91.0 and earlier to Cisco Wireless Control System WCS creates administrator accounts with default usernames and passwords, which allows remote attackers to gain privileges...

Cisco无线控制系统默认管理口令漏洞

BUGTRAQ ID: 26000 Cisco无线控制系统（WCS）是用于管理和控制Cisco统一无线网络的轻量级接入点和无线LAN控制器的集中系统级应用。 WCS在完成转换以后没有正确处理默认的帐号口令，远程攻击者可能利用此漏洞获取非授权访问。 CiscoWorks无线LAN解决方案引擎（WLSE）用户可以使用Cisco提供的转换工具转换到Cisco无线控制系统（WCS），这个转换工具使用默认的凭据创建和使用管理帐号。由于在转换过程中对更改这些凭据没有任何要求，因此攻击者可以利用这些拥有默认凭据的帐号在转换后获得对WCS的完全管理控制。 Cisco Wireless Control...

K2 KeyServer Default Credentials

The remote K2 KeyServer installation is configured to use default credentials to control access. Knowing these, an attacker can gain control of the affected application. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid27041; scriptversion"$Revision: 1.13 $";...

Default credentials

ldapscripts 1.4 and 1.7 sends a password as a command line argument when calling some LDAP programs, which might allow local users to read the password by listing the process and its arguments, as demonstrated by a call to ldappasswd in the changepassword function...

Default credentials

Quicksilver Forums before 1.4.1 allows remote attackers to obtain sensitive information by causing unspecified connection errors, which reveals the database password in the resulting error message...

Default credentials

The Cisco Video Surveillance IP Gateway Encoder/Decoder Standalone and Module firmware 1.8.1 and earlier, Video Surveillance SP/ISP Decoder Software firmware 1.11.0 and earlier, and the Video Surveillance SP/ISP firmware 1.23.7 and earlier have default passwords for the sypixx and root user...

Default credentials

backup-manager-upload in Backup Manager before 0.6.3 provides the FTP server hostname, username, and password as plaintext command line arguments during FTP uploads, which allows local users to obtain sensitive information by listing the process and its arguments, a different vulnerability than...

Default credentials

The Client Login Extension CLE in Novell Identity Manager before 3.5.1 20070730 stores the username and password in a local file, which allows local users to obtain sensitive information by reading this file...

Sybase ASA Default Database Password

The remote Sybase SQL Anywhere / Adaptive Server Anywhere server uses default credentials 'DBA' / 'SQL'. An attacker may use this flaw to execute commands against the remote host, as well as read your database content. C David Lodge 13/08/2007 This script is based on sybaseblankpassword.nasl whic...

Default credentials

2wire 1701HG and 2071 Gateway routers, with 5.29.51 and possibly 3.17.5 software, have a blank password by default...

Default credentials

NETGEAR formerly Infrant ReadyNAS RAIDiator before 4.00b2-p2-T1 beta creates a default SSH root password derived from the hardware serial number, which makes it easier for remote attackers to guess the password and obtain login access...

Default credentials

The management interface in ZyNOS firmware 3.62WK.6 on the Zyxel Zywall 2 device has a certain default password, which allows remote attackers to perform administrative actions...

Default credentials

changePW.php in AV Tutorial Script avtutorial 1.0 does not require authentication or knowledge of an old password for password changes, which allows remote attackers to change passwords for arbitrary users via a modified password parameter...

Default credentials

The Jedox Palo 1.5 client transmits the password in cleartext, which might allow remote attackers to obtain the password by sniffing the network, as demonstrated by starting Excel with the Palo plugin, opening a cube, and performing an Insert View...

CVE-2007-3446

The vulnerability CVE-2007-3446 affects BugMall Shopping Cart 2.5 and earlier. The issue is the default credentials: username “demo” and password “demo,” which allow remote attackers to obtain login access. This constitutes an authentication issue that can enable unauthorized access to the applic...

Default credentials

The Random Cookie Password functionality in the loaduser function in cgi-bin/cgi-lib/subs.pl in web-app.org WebAPP before 0.9.9.7 does not clear the 1 username, 2 password, 3 usertheme, and 4 userlang cookies for unauthorized users, which has unknown impact and remote attack vectors...

Default credentials

The dosetpassword function in modules/chanserv/set.c in IRC Services before 5.0.60 preserves channel founder privileges across a channel password change ChanServ SET PASSWORD, which allows remote authenticated users to obtain the new password through automated e-mail, or perform privileged action...

Default credentials

NMASINST in Novell Modular Authentication Service NMAS 3.1.2 and earlier on NetWare logs its invoking command line to NMASINST.LOG, which might allow local users to obtain the admin username and password by reading this file...

CVE-2007-3139

config/general.php in Quick.Cart 2.2 and earlier uses a default username and password, which allows remote attackers to access the application via a login action to admin.php. NOTE: this can be leveraged to upload and execute arbitrary code...

Default credentials

config/general.php in Quick.Cart 2.2 and earlier uses a default username and password, which allows remote attackers to access the application via a login action to admin.php. NOTE: this can be leveraged to upload and execute arbitrary code...