Default credentials

Progress Sitefinity 12.1 has a Weak Password Recovery Mechanism for a Forgotten Password because the HTTP Host header is mishandled...

OpenWrt ustream-ssl library information disclosure vulnerability (CNVD-2019-42439)

OpenWrt is a Linux operating system for embedded devices. ustream-ssl is one of the cryptographic libraries. The ustream-ssl library in OpenWrt version 18.06.4 and 15.05.1 is vulnerable to an information disclosure vulnerability that can be exploited by an attacker to attack vulnerable components...

Default credentials

Moodle before 2.2.2 has a default repository capabilities issue where all repositories are viewable by all users by default...

Western Digital SSD Dashboard and SanDisk SSD Dashboard Trust Management Issue Vulnerability

Western Digital SSD Dashboard and SanDisk SSD Dashboard are both products of Western Digital, Inc. Western Digital SSD Dashboard is a dashboard software for managing and monitoring SSD Solid State Drive devices. SanDisk SSD Dashboard is a dashboard software for managing and monitoring SanDisk SSD...

Default credentials

The keygen.sh script in Shibboleth SP 2.0 located in /usr/local/etc/shibboleth by default uses OpenSSL to create a DES private key which is placed in sp-key.pm. It relies on the root umask default 22 instead of chmoding the resulting file itself, so the generated private key is world readable by...

EyeWitness - Tool To Take Screenshots Of Websites, Provide Some Server Header Info, And Identify Default Credentials If Possible

EyeWitness is designed to take screenshots of websites provide some server header info, and identify default credentials if known. EyeWitness is designed to run on Kali Linux. It will auto detect the file you give it with the -f flag as either being a text file with URLs on each new line, nmap xm...

Default credentials

Pagure: XSS possible in file attachment endpoint...

Default credentials

/usr/local/www/freeradiusviewconfig.php in the freeradius3 package before 0.15.73 for pfSense on FreeBSD allows a user with an XSS payload as password or username to execute arbitrary javascript code on a victim browser...

CVE-2018-18929

The Tightrope Media Carousel Seneca HDn Windows-based appliance 7.0.4.104 is shipped with a default local administrator username and password. This can be found by a limited user account in an "unattend.xml" file left over on the C: drive from the Sysprep process. An attacker with this username a...

Default credentials

The Tightrope Media Carousel Seneca HDn Windows-based appliance 7.0.4.104 is shipped with a default local administrator username and password. This can be found by a limited user account in an "unattend.xml" file left over on the C: drive from the Sysprep process. An attacker with this username a...

CVE-2018-18929

The Tightrope Media Carousel Seneca HDn Windows-based appliance 7.0.4.104 is shipped with a default local administrator username and password. This can be found by a limited user account in an "unattend.xml" file left over on the C: drive from the Sysprep process. An attacker with this username a...

CVE-2018-18929

The CVE concerns Tightrope Media Carousel Seneca HDn Windows-based appliance 7.0.4.104, where a default local administrator username/password can be found in an unattend.xml left on the C: drive from Sysprep. An attacker with these credentials can gain administrator-level access to the system. Th...

Default credentials

An issue was discovered on Mitsubishi Electric ME-RTU devices through 2.02 and INEA ME-RTU devices through 3.0. Stored cleartext passwords could allow an unauthenticated attacker to obtain configured username and password combinations on the RTU due to the weak credentials management on the RTU. ...

Default credentials

Milesight IP security cameras through 2016-11-14 have a default root password in /etc/shadow that is the same across different customers' installations...

ham3d 1.1 Information Disclosure / Default Credentials

/ Exploit Title: ham3d Information Processing Script Local File Download & Default Password Vulnerability Exploit Author: Milad Hacking Vendor Homepage : http://www.ham3d.net/ Demo Script Link: http://wensoni.com Version : 1.1 Google Dork : inurl:fa/forgotpass.html Date: 2019-10-25 Tested on: Kal...

Default credentials

clonos.php in ClonOS WEB control panel 19.09 allows remote attackers to gain full access via change password requests because there is no session management...

CloudBees Jenkins Bumblebee HP ALM Plugin Trust Management Issues Vulnerability

CloudBees Jenkins Hudson Labs is the United States CloudBees company's set of Java-based development of continuous integration tools. The product is mainly used to monitor the continuous software version of the release/testing project and some timed tasks . Bumblebee HP ALM Plugin is used in one ...

Default credentials

templates/pad.html in Etherpad-Lite 1.7.5 has XSS when the browser does not encode the path of the URL, as demonstrated by Internet Explorer...

CVE-2019-13657

CA Performance Management 3.5.x, 3.6.x before 3.6.9, and 3.7.x before 3.7.4 have a default credential vulnerability that can allow a remote attacker to execute arbitrary commands and compromise system security...

CVE-2019-13657

CA Performance Management 3.5.x, 3.6.x before 3.6.9, and 3.7.x before 3.7.4 have a default credential vulnerability that can allow a remote attacker to execute arbitrary commands and compromise system security...