PT-2020-18318

Name of the Vulnerable Software and Affected Versions Opencast versions prior to 7.6 Opencast versions prior to 8.1 Description The issue allows an attacker to gain access to all servers that use the same credentials without needing the credentials, by exploiting a remember-me cookie based on a...

CVE-2020-6857

CarbonFTP v1.4 uses insecure proprietary password encryption with a hard-coded weak encryption key. The key for local FTP server passwords is hard-coded in the binary...

CVE-2020-6857

CarbonFTP v1.4 uses insecure proprietary password encryption with a hard-coded weak encryption key. The key for local FTP server passwords is hard-coded in the binary...

CVE-2020-6857

CarbonFTP v1.4 uses insecure proprietary password encryption with a hard-coded weak encryption key. The key for local FTP server passwords is hard-coded in the binary...

PT-2020-19269

Name of the Vulnerable Software and Affected Versions CarbonFTP version 1.4 Description The issue concerns the use of insecure proprietary password encryption in CarbonFTP. Specifically, the software uses a hard-coded weak encryption key for local FTP server passwords, which is embedded directly ...

CVE-2020-6857: Use of a Broken or Risky Cryptographic Algorithm

CarbonFTP v1.4 uses insecure proprietary password encryption with a hard-coded weak encryption key. The key for local FTP server passwords is hard-coded in the binary...

Neowise CarbonFTP 1.4 Insecure Proprietary Password Encryption Exploit

Credits: John Page aka hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/NEOWISE-CARBONFTP-v1.4-INSECURE-PROPRIETARY-PASSWORD-ENCRYPTION.txt + twitter.com/hyp3rlinx + ISR: ApparitionSec Vendor www.neowise.com Product CarbonFTP v1.4 CarbonFTP is a...

Cisco Data Center Network Manager SecurityManager Hard-coded Cryptographic Key Authentication Bypass Vulnerability

This vulnerability allows remote attackers to bypass authentication on affected installations of Cisco Data Center Network Manager. Authentication is not required to exploit this vulnerability. The specific flaw exists within the validation of SSO tokens of SOAP packets. The issue results from th...

CVE-2019-6693

Use of a hard-coded cryptographic key to cipher sensitive data in FortiOS configuration backup file may allow an attacker with access to the backup file to decipher the sensitive data, via knowledge of the hard-coded key. The aforementioned sensitive data includes users' passwords except the...

CVE-2019-6693

Fortinet FortiOS contains a vulnerability CVE-2019-6693: use of a hard-coded cryptographic key to cipher sensitive data in FortiOS configuration backup files. An attacker with access to the backup file could decrypt sensitive data, including users’ passwords (excluding admin), private keys’ passp...

PT-2019-6279

Name of the Vulnerable Software and Affected Versions FortiOS, FortiManager, and FortiAnalyzer affected versions not specified Description The vulnerability involves the use of a hard-coded cryptographic key to encrypt sensitive data within configuration backup files and CLI configurations. An...

Fortinet FortiOS Trust Management Issue Vulnerability

Fortinet FortiOS is a set of security operating system dedicated to FortiGate network security platform from American Fita Fortinet. The system provides users with firewall, antivirus, IPSec/SSLVPN, Web content filtering and anti-spam and other security features. A security vulnerability exists i...

CVE-2019-13929: Use of Hard-coded Cryptographic Key

A vulnerability has been identified in SIMATIC IT UADM All versions V1.3. An authenticated remote attacker with network access to port 1434/tcp of SIMATIC IT UADM could potentially recover a password that can be used to gain read and write access to the related TeamCenter station. The security...

CVE-2019-10990: Use of Hard-coded Cryptographic Key

Red Lion Controls Crimson, version 3.0 and prior and version 3.1 prior to release 3112.00, uses a hard-coded password to encrypt protected files in transit and at rest, which may allow an attacker to access configuration files...

CVE-2019-13399

Dynacolor FCM-MB40 v1.2.0.0 devices have a hard-coded SSL/TLS key that is used during an administrator's SSL conversation...

PT-2019-13311

Name of the Vulnerable Software and Affected Versions Dynacolor FCM-MB40 version 1.2.0.0 Description The issue concerns a hard-coded SSL/TLS key used in administrator SSL conversations. Recommendations For Dynacolor FCM-MB40 version 1.2.0.0, consider changing the hard-coded SSL/TLS key to a uniqu...

WAGO Industrial Managed Switches 852-303, 852-1305 and 852-1505 Trust Management Issue Vulnerability (CNVD-2020-36950)

WAGO Industrial Managed Switches 852-303 and so on are a kind of industrial managed switches from Germany WAGO company. A trust management issue vulnerability exists in the WAGO Industrial Managed Switches 852-303 prior to version 1.2.2.S0, 852-1305 prior to version 1.1.6.S0, and 852-1505 prior t...

CVE-2019-12776

An issue was discovered on the ENTTEC Datagate MK2, Storm 24, Pixelator, and E-Streamer MK2 with firmware 70044update05032019-482. They include a hard-coded SSH backdoor for remote SSH and SCP access as the root user. A command in the relocate and relocaterevB scripts copies the hardcoded key to...

CVE-2019-12376

Use of a hard-coded encryption key in Ivanti LANDESK Management Suite LDMS, aka Endpoint Manager 10.0.1.168 Service Update 5 may lead to full managed endpoint compromise by an authenticated user with read privileges...

Computrols CBAS Web Hardcoded Encryption Key Vulnerability

CBAS Web is a Web-based building management system BMS from Computrols. A hard-coded encryption key vulnerability exists in Computrols CBAS Web. The vulnerability stems from multiple scripts that contain hard-coded encryption keys used to decrypt database backup files. An authenticated attacker...