CVE-2018-17485

Lobby Track Desktop contains default administrative credentials. An attacker could exploit this vulnerability to gain full access to the application...

CVE-2018-17485

Lobby Track Desktop contains default administrative credentials. An attacker could exploit this vulnerability to gain full access to the application...

Lobby Track Desktop Default Admin Credentials Vulnerability

Jolly Technologies Lobby Track Desktop is a desktop visitor management application from Jolly Technologies USA. The program has features such as pre-registering visitors, capturing photos and scanning driver's licenses. A security vulnerability exists in Jolly Technologies Lobby Track Desktop...

CVE-2018-17492

EasyLobby Solo contains default administrative credentials. An attacker could exploit this vulnerability to gain full access to the application...

CVE-2018-17497

CVE-2018-17497 affects eVisitorPass. It reports default administrative credentials that could let a local attacker gain full access to the application. CVSSv3.0 base score 7.8 (HIGH) with LOCAL access, low attack complexity, no user interaction, and HIGH confidentiality, integrity, and availabili...

CVE-2018-17497

eVisitorPass contains default administrative credentials. An attacker could exploit this vulnerability to gain full access to the application...

The vulnerability of the embedded software in the CNC11 TITANIUM mini system allows a hacker to gain full access to the system.

The vulnerability of the embedded software of the CNC11 TITANIUM mini system is related to the use of a default weak password for the root account, information about which is not available in the documentation. Exploiting this vulnerability could allow an attacker, operating remotely, to gain ful...

EVLink Parking Code Injection Vulnerability

Schneider Electric EVLink Parking is a commercial electric vehicle charging solution from Schneider Electric, France. A code injection vulnerability exists in Schneider Electric EVLink Parking 3.2.0-12v1 and prior versions. A remote attacker could exploit this vulnerability to execute code and ga...

EVlink Parking SQL Injection Vulnerability

Schneider Electric EVLink Parking is a commercial electric vehicle charging solution from Schneider Electric, France. A SQL injection vulnerability exists in Schneider Electric EVLink Parking 3.2.0-12v1 and prior versions. A remote attacker could exploit this vulnerability to gain full access to...

Default credentials

ChipsBank UMPTool saves the password to the NAND with a simple substitution cipher, which allows attackers to get full access when having physical access to the device...

IBM DB2 power lifting vulnerability (CNVD-2018-13458)

IBM DB2 is a set of relational database management system from IBM in the United States. The main execution environments for this system are UNIX, Linux, IBM i, z/OS, and Windows server versions. An untrustworthy search path vulnerability exists in IBM DB2 including DB2 Connect Server based on...

Stored XSS in contacts via group shares (NC-SA-2018-005)

A missing sanitization of search results for an autocomplete field could lead to a stored XSS requiring user-interaction. The missing sanitization only affected group names, hence malicious search results could only be crafted by privileged users like admins or group admins...

Canon LBP7110Cw Authentication Bypass

Exploit Title: Canon LBP7110Cw - Authentication Bypass Date: 2018-06-07 Exploit Author: Huy Kha Vendor Homepage: http://global.canon.com Version: LBP7110Cw CVE: CVE-2018-12049 Severity: High Leads to full System Manager Mode account take-over Description : A remote attacker can bypass the...

Canon LBP6030w Authentication Bypass

Exploit Title: Canon LBP6030w - Authentication Bypass Date: 2018-06-07 Exploit Author: Huy Kha Vendor Homepage: http://global.canon.com Version: LBP6030w Severity: High Leads to full System Manager Mode account take-over CVE: CVE-2018-12049 Description : A remote attacker can bypass the System...

CVE-2018-12048

A remote attacker can bypass the Management Mode on the Canon LBP7110Cw web interface without a PIN for /checkLogin.cgi via vectors involving /portaltop.html to get full access to the device. NOTE: the vendor reportedly responded that this issue occurs when a customer keeps the default settings...

Design/Logic Flaw

DISPUTED A remote attacker can bypass the Management Mode on the Canon LBP7110Cw web interface without a PIN for /checkLogin.cgi via vectors involving /portaltop.html to get full access to the device. NOTE: the vendor reportedly responded that this issue occurs when a customer keeps the default...

Design/Logic Flaw

DISPUTED A remote attacker can bypass the System Manager Mode on the Canon LBP6030w web interface without a PIN for /checkLogin.cgi via vectors involving /portaltop.html to get full access to the device. NOTE: the vendor reportedly responded that this issue occurs when a customer keeps the defaul...

CVE-2018-12048

A remote attacker can bypass the Management Mode on the Canon LBP7110Cw web interface without a PIN for /checkLogin.cgi via vectors involving /portaltop.html to get full access to the device. NOTE: the vendor reportedly responded that this issue occurs when a customer keeps the default settings...

CVE-2018-12049

A remote attacker can bypass the System Manager Mode on the Canon LBP6030w web interface without a PIN for /checkLogin.cgi via vectors involving /portaltop.html to get full access to the device. NOTE: the vendor reportedly responded that this issue occurs when a customer keeps the default setting...

Canon LBP7110Cw Access Control Vulnerability

The Canon LBP7110Cw is a color laser printer device from Canon Japan. A security vulnerability exists in the web interface in the Canon LBP7110Cw. The vulnerability can be exploited by an attacker to bypass the administrative mode and gain full access to the device without a PIN...