CVE-2017-1190: Undefined Security Weakness

IBM Emptoris Strategic Supply Management Platform 10.x and 10.1 could allow a local user with special access roles to execute arbitrary code on the system. By manipulating a configurable property, an attacker could exploit this vulnerability to gain full control over the system. IBM X-Force ID:...

Cisco IOS XR Software Incorrect Permissions Privilege Escalation Vulnerability

A vulnerability in the CLI of Cisco IOS XR Software could allow an authenticated, local attacker to execute arbitrary code at the root privilege level on an affected system. The vulnerability is due to incorrect permissions that are given to a set of users. An attacker could exploit this...

F5 BIG-IP Default Password Vulnerability

The F5 BIG-IP is a load balancer that uses a variety of distribution algorithms to distribute network requests to available servers in a server cluster, enabling network visitors to have the best possible networking experience by managing incoming Web data traffic and increasing effective network...

Juniper Networks NorthStar Controller Insufficient Authentication Vulnerability

Juniper Networks NorthStar Controller is a powerful and flexible traffic engineering solution that enables granular visualization and control of IP/MPLS flows in carrier networks. A lack of authentication vulnerability exists in Juniper Networks NorthStar Controller, which can be exploited by...

Moxa AWK-3131A Hard-coded Administrator Credentials Vulnerability

Talos Vulnerability Report TALOS-2017-0231 Moxa AWK-3131A Hard-coded Administrator Credentials Vulnerability April 21, 2017 Report ID CVE-2016-8717 Summary An exploitable Use of Hard-coded Credentials vulnerability exists in the Moxa AWK-3131A Wireless Access Point running firmware 1.1. The devic...

CVE-2017-3834

A vulnerability in Cisco Aironet 1830 Series and Cisco Aironet 1850 Series Access Points running Cisco Mobility Express Software could allow an unauthenticated, remote attacker to take complete control of an affected device. The vulnerability is due to the existence of default credentials for an...

Multiple Vulnerabilities in Dahua IP Camera

Dahua IP Camera is a webcam from Dahua, China. An elevation of privilege and information disclosure vulnerability exists in Dahua IP Camera version 3.200.0001.6. An attacker can exploit this vulnerability by sending a specially crafted request to log into the IP Camera and gain full control of th...

CVE-2017-7253

Dahua IP Camera devices 3.200.0001.6 can be exploited via these steps: 1. Use the default low-privilege credentials to list all users via a request to a certain URI. 2. Login to the IP camera with admin credentials so as to obtain full control of the target IP camera. During exploitation, the fir...

CVE-2016-10305

Trango Apex = 2.1.1, ApexLynx 2.0, ApexOrion 2.0, ApexPlus = 3.2.0, Giga = 2.6.1, GigaLynx 2.0, GigaOrion 2.0, GigaPlus = 3.2.3, GigaPro = 1.4.1, StrataLink 3.0, and StrataPro devices have a built-in, hidden root account, with a default password that was once stored in cleartext within a software...

CVE-2016-10306

Trango Altum AC600 devices have a built-in, hidden root account, with a default password of abcd1234. This account is accessible via SSH and/or TELNET, and grants access to the underlying embedded UNIX OS on the device, allowing full control over it...

CVE-2016-10308

Siklu EtherHaul radios before 3.7.1 and 6.x before 6.9.0 have a built-in, hidden root account, with an unchangeable password that is the same across all devices. This account is accessible via both SSH and the device's web interface and grants access to the underlying embedded Linux OS on the...

CVE-2016-10307

Trango ApexLynx 2.0, ApexOrion 2.0, GigaLynx 2.0, GigaOrion 2.0, and StrataLink 3.0 devices have a built-in, hidden root account, with a default password for which the MD5 hash value is public but the cleartext value is perhaps not yet public. This account is accessible via SSH and/or TELNET, and...

CVE-2016-10305: Use of Hard-coded Credentials

Trango Apex = 2.1.1, ApexLynx 2.0, ApexOrion 2.0, ApexPlus = 3.2.0, Giga = 2.6.1, GigaLynx 2.0, GigaOrion 2.0, GigaPlus = 3.2.3, GigaPro = 1.4.1, StrataLink 3.0, and StrataPro devices have a built-in, hidden root account, with a default password that was once stored in cleartext within a software...

CVE-2016-10306: Use of Hard-coded Credentials

Trango Altum AC600 devices have a built-in, hidden root account, with a default password of abcd1234. This account is accessible via SSH and/or TELNET, and grants access to the underlying embedded UNIX OS on the device, allowing full control over it...

Multiple Bitdefender Product DLL Load Local Code Injection Vulnerabilities

Bitdefender Total Security and others are antivirus programs from the Romanian company Bitdefender. A local code injection vulnerability exists in multiple Bitdefender products. A local attacker could use this vulnerability to execute arbitrary code in the context of the system running in the...

Multiple Avast Product DLL Load Local Code Injection Vulnerabilities

Avast Pro Antivirus and others are antivirus programs from the Czech company Avast. A local code injection vulnerability exists in several Avast products. A local attacker could use this vulnerability to execute arbitrary code in the context of a system running in an affected program to gain full...

Multiple AVG Product DLL Load Local Code Injection Vulnerabilities

AVG Ultimate and others are antivirus programs from the Czech company AVG. A local code injection vulnerability exists in several AVG products. A local attacker can exploit this vulnerability to execute arbitrary code in the context of the system running in the affected program to gain full contr...

Multiple Avira Product DLL Load Local Code Injection Vulnerabilities

Avira Total Security Suite and others are antivirus programs from the German company Little Red Umbrella Avira. A local code injection vulnerability exists in several Avira products. A local attacker can exploit this vulnerability to execute arbitrary code in the context of a system running in an...

CVE-2017-3854: Improper Authentication

A vulnerability in the mesh code of Cisco Wireless LAN Controller WLC software could allow an unauthenticated, remote attacker to impersonate a WLC in a meshed topology. The vulnerability is due to insufficient authentication of the parent access point in a mesh configuration. An attacker could...

Trango Altum AC600 Default Root Login Vulnerability

Exploit for hardware platform in category web applications + Credits: Ian Ling + Website: iancaling.com + Source: http://blog.iancaling.com/post/155395764003 Vendor: ================= https://www.trangosys.com/ Product: ====================== -Altum AC600 Vulnerability Details:...