CVE-2023-37755

i-doit pro 25 and below and I-doit open 25 and below are configured with insecure default administrator credentials, and there is no warning or prompt to ask users to change the default password and account name. Unauthenticated attackers can exploit this vulnerability to obtain Administrator...

CMS NEXIN 2.0 Insecure Settings

==================================================================================================================================== | Title : CMS NEXIN engine v2.0 Insecure Settings Vulnerability | | Author : indoushka | | Tested on : windows 10 Français V.Pro / browser : Mozilla firefox...

AMSS++ 2.0 Insecure Settings

==================================================================================================================================== | Title : AMSS++ v 2.0 Insecure Settings Vulnerability | | Author : indoushka | | Tested on : windows 10 Français V.Pro / browser : Mozilla firefox 65.032-bit | |...

CVE-2022-36222

Nokia Fastmile 3tg00118abad52 devices shipped by Optus are shipped with a default hardcoded admin account of admin:Nq+L5st7o This account can be used locally to access the web admin interface...

CVE-2022-45045

Multiple Xiongmai NVR devices, including MBD6304T V4.02.R11.00000117.10001.131900.00000 and NBD6808T-PL V4.02.R11.C7431119.12001.130000.00000, allow authenticated users to execute arbitrary commands as root, as exploited in the wild starting in approximately 2019. A remote and authenticated...

ManageEngine DataSecurity Plus Xnode Enumeration

This module exploits default admin credentials for the DataEngine Xnode server in DataSecurity Plus versions prior to 6.0.1 6011 in order to dump the contents of Xnode data repositories tables, which may contain a limited amount of Active Directory information including domain names, host names,...

Zebra ZTC Printer Web Interface Default Admin Password

The remote host has a web interface with a default administrative password. %NASLMINLEVEL 80900 C Tenable, Inc. include'compat.inc'; if description scriptid164505; scriptversion"1.1"; scriptsetattributeattribute:"pluginmodificationdate", value:"2022/08/30"; scriptnameenglish:"Zebra ZTC Printer We...

PT-2022-15952 · Softing · Edgeaggregator +2

Name of the Vulnerable Software and Affected Versions: Softing Secure Integration Server, edgeConnector, and edgeAggregator software affected versions not specified Description: The issue concerns the use of default administrator credentials, with the username as admin and the password as admin...

CVE-2021-42850

A weak default administrator password for the web interface and serial port was reported in some Lenovo Personal Cloud Storage devices that could allow unauthorized device access to an attacker with physical or local network access...

Verizon 4G LTE Network Extender 0.4.038.2131 Weak Credential Algorithm

Verizon 4G LTE Network Extender Weak Credentials Algorithm Vendor: Verizon Communications Inc. Product web page: https://www.verizon.com Affected version: GA4.38 - V0.4.038.2131 Summary: An LTE Network Extender enhances your indoor and 4G LTE data and voice coverage to provide better service for...

Verizon 4G LTE Network Extender Weak Credentials Algorithm

Summary An LTE Network Extender enhances your indoor and 4G LTE data and voice coverage to provide better service for your 4G LTE mobile devices. It's an extension of our 4G LTE network that's placed directly in your home or office. The LTE Network Extender works with all Verizon-sold 4G LTE mobi...

Exploit for Authentication Bypass by Spoofing in Apache Apisix

CVE-2022-24112-POC Apache APISIX 2.12.1 Rem...

Centralisation Risk: TokenManager Gives Unnecessary Permissions to The Default Admin Through changeDepositBoxAddress() Which May Cause The Bridge to Get Stuck

Lines of code Vulnerability details Impact The function changeDepositBoxAddress allows the DEFAULTADMINROLE to change the depositBox associated with a TokenManager. If the newDepositBox is incorrectly set either accidentally or maliciously it will cause the bridge to become stuck. For example if ...

CVE-2022-23320

XMPie uStore 12.3.7244.0 allows for administrators to generate reports based on raw SQL queries. Since the application ships with default administrative credentials, an attacker may authenticate into the application and exfiltrate sensitive information from the database...

CVE-2021-43284

An issue was discovered on Victure WR1200 devices through 1.0.3. The root SSH password never gets updated from its default value of admin. This enables an attacker to gain control of the device through SSH regardless of whether the admin password was changed on the web interface...

CVE-2021-28909

BAB TECHNOLOGIE GmbH eibPort V3 prior version 3.9.1 allow unauthenticated attackers to access uncontrolled the login service at /webif/SecurityModule in a brute force attack. The password could be weak and default username is known as 'admin'. This is usable and part of an attack chain to gain SS...

CVE-2020-25753

An issue was discovered on Enphase Envoy R3.x and D4.x devices with v3 software. The default admin password is set to the last 6 digits of the serial number. The serial number can be retrieved by an unauthenticated user at /info.xml...

CVE-2020-25753

An issue was discovered on Enphase Envoy R3.x and D4.x devices with v3 software. The default admin password is set to the last 6 digits of the serial number. The serial number can be retrieved by an unauthenticated user at /info.xml...

U.S. Dept Of Defense: Default Admin Username and Password on █████ Server at █████████mil

Description: A ██████ Server is running at https://███mil you can access the login at https://████mil/█████████ the application is using the default "Administrator for the default organization" credentials POC Go to https://███mil/████████ and login with █████ ██████████ ████ ████ How to remediat...

CVE-2021-30165

The default administrator account & password of the EDIMAX wireless network camera is hard-coded. Remote attackers can disassemble firmware to obtain the privileged permission and further control the devices...