Cisco TelePresence Conductor Default Credentials (Web UI)

It is possible to log into the remote Cisco TelePresence Conductor installation by providing the default credentials. A remote, unauthenticated attacker can exploit this to gain administrative control. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc';...

Pandora Fms - SQL Injection Remote Code Execution (Metasploit)

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 'Pandora FMS SQLi Remote Code Execution', 'Description' = %q This module attempts to exploit multiple issues in order to gain remote...

Device42 Embedded Credentials

Remote Authenticated Root in Device42 DCIM Appliance Manager v5.10 and v6.0 http://www.device42.com/download/ Device42 ships virtual appliances ready for production use as a trial essentially dictated by the license provided. The Appliance Manager listens on HTTP no SSL on port 4242 with default...

Pandora FMS SQL Injection Remote Code Execution Vulnerability

This Metasploit module attempts to exploit multiple issues in order to gain remote code execution under Pandora FMS versions equal to and prior to 5.0 SP2. First, an attempt to authenticate using default credentials is performed. If this method fails, a SQL injection vulnerability is leveraged in...

Remote Code Execution in Popular Hikvision Surveillance DVR

A number Hikvision digital video recorders contain vulnerabilities that an attacker could remotely exploit in order to gain full control of those devices. According to a report written by the security firm Rapid7, Hikvision’s DVRs contain three fairly typical buffer overflows in the request...

Advantech EKI-6340 2.05 Command Injection

Core Security - Corelabs Advisory http://corelabs.coresecurity.com/ Advantech EKI-6340 Command Injection 1. Advisory Information Title: Advantech EKI-6340 Command Injection Advisory ID: CORE-2014-0009 Advisory URL: http://www.coresecurity.com/advisories/advantech-eki-6340-command-injection Date...

CBN CH6640E/CG6640E Wireless Gateway Series Multiple Vulnerabilities

No description provided by source. CBN CH6640E/CG6640E Wireless Gateway Series Multiple Vulnerabilities Vendor: Compal Broadband Networks CBN, Inc. Product web page: http://www.icbn.com.tw Affected version: Model: CH6640 and CH6640E Hardware version: 1.0 Firmware version: CH6640-3.5.11.7-NOSH Boo...

SolarWinds Log and Event Manager Default Credentials

The remote SolarWinds Log and Event Manager install, a security information and event management SIEM solution, is protected with a set of known default credentials that allow administrator level access to the appliance. %NASLMINLEVEL 70300 C Tenable Network Security, Inc...

Cisco UCS Director Default Credentials (Web UI)

It is possible to log into the remote Cisco UCS Director installation by providing the default credentials. A remote, unauthenticated attacker can exploit this to gain administrative control. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc'; include'compat.inc...

Cisco UCS Director Default Credentials (SSH)

The account 'shelladmin' is using a default password. A remote, unauthenticated attacker can exploit this to log in as a privileged user and gain access to the Cisco UCS Director configuration menu. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid78768;...

IT Security Horror Story: Digging your own grave with Default Credentials

I recently performed a penetration test that really required no "hacking skills" whatsoever. I was able to obtain domain administrator rights simply by logging into web applications and network hardware using default credentials...

IPMI Default Credentials (IPMI Protocol) - Active Check

It was possible to find default password/username combinations for the Intelligent Platform Management Interface IPMI protocol. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

CBN CH6640E/CG6640E Wireless Gateway Series Multiple Vulnerabilities

Exploit for hardware platform in category web applications CBN CH6640E/CG6640E Wireless Gateway Series Multiple Vulnerabilities Vendor: Compal Broadband Networks CBN, Inc. Product web page: http://www.icbn.com.tw Affected version: Model: CH6640 and CH6640E Hardware version: 1.0 Firmware version:...

CBN CH6640E/CG6640E Wireless Gateway Series - Multiple Vulnerabilities

CBN CH6640E/CG6640E Wireless Gateway Series Multiple Vulnerabilities Vendor: Compal Broadband Networks CBN, Inc. Product web page: http://www.icbn.com.tw Affected version: Model: CH6640 and CH6640E Hardware version: 1.0 Firmware version: CH6640-3.5.11.7-NOSH Boot version: PSPU-BootBBU...

Default credentials

EMC Avamar 6.0.x, 6.1.x, and 7.0.x in Avamar Data Store ADS GEN4S and Avamar Virtual Edition AVE, when Password Hardening before 2.0.0.4 is enabled, uses UNIX DES crypt for password hashing, which makes it easier for context-dependent attackers to obtain cleartext passwords via a brute-force atta...

Wonderful World-Wide CMS SQL Injection / Default Credentials

Title : Wonderful World-wide CMS Multiple Vulnerability Author : eX-Sh1Ne Facebook : fb..me/ShiNe.gov // fb.com/EksShiNe Date : 24/10/2014 Category : Web Applications Type : PHP Vendor : n/a Download : n/a Greetz : Java Defacer Team - Sanjungan Jiwa - All Indonesian Defacer Team Thanks : Admin07,...

Default credentials

Jenkins before 1.583 and LTS before 1.565.3 allows remote authenticated users with the Job/READ permission to obtain the default value for the password field of a parameterized job by reading the DOM...

Default credentials

z3c.form, as used in Plone before 4.2.3 and 4.3 before beta 1, allows remote attackers to obtain the default form field values by leveraging knowledge of the form location and the element id...

SolarWinds Log and Event Manager Static Credentials (CVE-2014-5504)

A policy bypass vulnerability has been reported in SolarWinds Log and Event Manager. The vulnerability is due to the usage of static/default credentials to access the HyperSQL database. A remote attacker can exploit this vulnerability to access the database with administrator privileges...

Silver Peak VX Default Credentials

The remote web server hosts a Silver Peak VX installation that uses default credentials for the 'admin' account. A remote attacker can exploit this to gain administrative access to the application. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc';...