4397 matches found
Cross site request forgery (csrf)
A CSRF issue in /api/crontab on iRZ Mobile Routers through 2022-03-16 allows a threat actor to create a crontab entry in the router administration panel. The cronjob will consequently execute the entry on the threat actor's defined interval, leading to remote code execution, allowing the threat...
Default credentials
An issue was discovered in MISP before 2.4.156. An SVG org logo which may contain JavaScript is not forbidden by default...
Exploit for Cross-Site Request Forgery (CSRF) in Irz Ru21_Firmware
ez-iRZ Exploit for CVE-2022-27226 Cross Site Request Forgery...
Default credentials
RunAsSpc 4.0 uses a universal and recoverable encryption key. In possession of a file encrypted by RunAsSpc, an attacker can recover the credentials that were used...
MantisBT Default Credentials (HTTP)
The remote MantisBT instance is using known default credentials for the HTTP login. Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This...
Default credentials
A vulnerable design in fingerprint matching algorithm prior to SMR Mar-2022 Release 1 allows physical attackers to perform brute force attack on screen lock password...
InsightVM Scan Engine: Understanding MAC Address Discovery
Written in collaboration with Jimmy Cancilla When scanning an asset, one key piece of data that the InsightVM Scan Engine collects is the MAC address of the network interface used during the connection. The MAC address is one of several attributes used by the Security Console to perform asset...
CVE-2021-43774
A risky-algorithm issue was discovered on Fujifilm DocuCentre-VI C4471 1.8 devices. An attacker that obtained access to the administrative web interface of a printer e.g., by using the default credentials can download the address book file, which contains the list of users domain users, FTP users...
Default credentials
A risky-algorithm issue was discovered on Fujifilm DocuCentre-VI C4471 1.8 devices. An attacker that obtained access to the administrative web interface of a printer e.g., by using the default credentials can download the address book file, which contains the list of users domain users, FTP users...
CVE-2021-43774
A risky-algorithm issue was discovered on Fujifilm DocuCentre-VI C4471 1.8 devices. An attacker that obtained access to the administrative web interface of a printer e.g., by using the default credentials can download the address book file, which contains the list of users domain users, FTP users...
Default credentials
Weak Password Recovery Mechanism for Forgotten Password in GitHub repository microweber/microweber prior to 1.3...
Default credentials
SangforCSClient.exe in Sangfor VDI Client 5.4.2.1006 allows attackers, when they are able to read process memory, to discover the contents of the Username and Password fields...
Default credentials
In JetBrains TeamCity before 2021.2.1, editing a user account to change its password didn't terminate sessions of the edited user...
Default credentials
Due to usernames/passwords being stored in plaintext in Random Access Memory RAM, a local, authenticated attacker could gain access to certain credentials, including Windows Logon credentials...
Default credentials
An issue was discovered in Cobbler before 3.3.1. Files in /etc/cobbler are world readable. Two of those files contain some sensitive information that can be exposed to a local user who has non-privileged access to the server. The users.digest file contains the sha2-512 digest of users in a Cobble...
Default credentials
Jenkins Pipeline: Build Step Plugin 2.15 and earlier reveals password parameter default values when generating a pipeline script using the Pipeline Snippet Generator, allowing attackers with Item/Read permission to retrieve the default password parameter value from jobs...
Moxa MXView Series Web Application authentication bypass vulnerability
Summary An authentication bypass vulnerability exists in the Web Application functionality of Moxa MXView Series 3.2.4. A specially-crafted HTTP request can lead to unauthorized access. An attacker can send an HTTP request to trigger this vulnerability. Tested Versions Moxa MXView Series 3.2.4...
Default credentials
A vulnerability has been identified in SIMATIC PCS 7 V8.2 All versions, SIMATIC PCS 7 V9.0 All versions, SIMATIC PCS 7 V9.1 All versions V9.1 SP1, SIMATIC WinCC V15 and earlier All versions V15 SP1 Update 7, SIMATIC WinCC V16 All versions V16 Update 5, SIMATIC WinCC V17 All versions V17 Update 2,...
CVE-2022-23320
Summary: CVE-2022-23320 affects XMPie uStore 12.3.7244.0. The issue is an authentication/authorization weakness where default administrative credentials allow attackers to log in and exploit the ability to run or access raw SQL-based reports , leading to potential exfiltration of sensitive databa...
CVE-2022-23320
XMPie uStore 12.3.7244.0 allows for administrators to generate reports based on raw SQL queries. Since the application ships with default administrative credentials, an attacker may authenticate into the application and exfiltrate sensitive information from the database...