CVE-2017-6626: Exposure of Sensitive Information to an Unauthorized Actor

A vulnerability in the Cisco Finesse Notification Service for Cisco Unified Contact Center Enterprise UCCE 11.51 and 11.61 could allow an unauthenticated, remote attacker to retrieve information from agents using the Finesse Desktop. The vulnerability is due to the existence of a user account tha...

PT-2017-16866

Name of the Vulnerable Software and Affected Versions Hyundai Motor America Blue Link versions 3.9.4 through 3.9.5 Description A security issue was found where the application uses a hard-coded decryption password, potentially exposing sensitive user information. Recommendations For versions 3.9....

Django Hardcoded Password Security Bypass Vulnerability

Django is a set of Django Software Foundation based on the Python language open source Web application framework. The framework includes object-oriented mapper , view system , template system and so on. Django has a hard-coded password security bypass vulnerability that can be exploited by an...

Crestron Electronics DM-TXRX-100-STR Hardcoded Password Vulnerability

The Crestron Electronics DM-TXRX-100-STR is a multimedia streaming codec. The Crestron Electronics DM-TXRX-100-STR 1.3039.00040 has a hard-coded password for the admin account. This could allow a remote attacker to gain access through the web management interface...

Schneider Electric PowerLogic PM8ECC Hard-coded Password Vulnerability

OVERVIEW Independent researcher He Congwen has identified a hard-coded password vulnerability in Schneider Electric’s PowerLogic PM8ECC device. Schneider Electric has produced a patch to mitigate this vulnerability. This vulnerability could be exploited remotely. AFFECTED PRODUCTS The following...

Fonality contains a hard-coded password and embedded SSL private key

Overview Fonality previously trixbox Pro version 12.6 and later uses a hard-coded password, and the accompanying HUDweb plugin embeds a private SSL key. Description CWE-259: Use of Hard-coded Password - CVE-2016-2362According to the reporter, FTP is used to sync phone configurations for users, by...

Lorex ECO DVR Backdoor Account

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 1. ADVISORY INFORMATION ======================= Product: Lorex ECO DVR Vendor URL: https://www.lorextechnology.com/ Type: Hard coded password CWE-259 Date found: 2016-05-04 Date published: 2016-05-30 CVE: - 2. CREDITS ========== This vulnerability w...

Systech SysLINK M2M Modular Gateway Privilege Gain Vulnerability

The Systech SysLINK SL-1000 M2M Machine-to-Machine Modular Gateway is a router product from Systech, Inc. that provides DHCP, NAT, VPN, and firewall features. A privilege-acquisition vulnerability exists in the web interface of the Systech SysLINK SL-1000 M2M Modular Gateway using firmware prior ...

SysLINK M2M Modular Gateway contains multiple vulnerabilities

Overview The SysLINK SL-1000 M2M Machine-to-Machine Modular Gateway contains multiple vulnerabilities. Description According to the researcher, the SysLINK SL-1000 M2M Modular Gateway contains multiple vulnerabilities:CWE-259: Use of Hard-coded Password - CVE-2016-2331 By default, the device's we...

Netis/Netcore Router Hard-Coded Backdoor

A backdoor in Netis/Netcore routers has been reported. The routers are protected by a single hard-coded password. The exploitation of this backdoor could compromise the network protected by the device...

Swann SRNVW-470 allows unauthorized access to video stream and contains a hard-coded password

Overview Swann network video recorder NVR devices contain a hard-coded password and do not require authentication to view the video feed when accessing from specific URLs. Description CWE-259: Use of Hard-coded Password - CVE-2015-8286 According to the researcher, the Swann SRNVW-470LCD and Swann...

Zhuhai Raysharp firmware for DVRs from multiple vendors contains hard-coded credentials

Overview Digital Video Recorders DVRs, security cameras, and possibly other devices from multiple vendors use a firmware derived from Zhuhai RaySharp that contains a hard-coded root password. Description CWE-259: Use of Hard-coded Password- CVE-2015-8286 According to the reporter, DVR devices bas...

OpenELEC and RasPlex have a hard-coded SSH root password

Overview OpenELEC and derivatives utilize a hard-coded default root password, and enable SSH root access by default. Description CWE-259: Use of Hard-coded Password OpenELEC has a hard-coded root password. The root partition is by default read-only, preventing a user from changing the password on...

Unspecified Vulnerability in Harman AMX

Harman AMX is a series of conversion controller products from Harman USA. A security vulnerability exists in the 'setUpSubtleUserAccount' function in the /bin/bw URI in versions of Harman AMX prior to 2016-01-20, which stems from the use of a hard-coded password for the 1MB@tMaN account. A remote...

Oh Snap! Lenovo protects your Security with '12345678' as Hard-Coded Password in SHAREit

What do you expect a tech giant to protect your backdoor security with? Holy Cow! It's "12345678" as a Hard-Coded Password. Yes, Lenovo was using one of the most obvious, awful passwords of all time as a hard-coded password in its file sharing software SHAREit that could be exploited by anyone wh...

Lenovo SHAREit App Hard-Coded Password

Lenovo today has patched a number of vulnerabilities that jeopardize private data, which are largely enabled by a simple hard-coded password in a freely available file-sharing application. The flaws were found in in the Lenovo ShareIT application for Android and Windows by researchers at Core...

Lenovo ShareIT Information Disclosure / Hardcoded Password

Advisory Information Title: Lenovo ShareIT Multiple Vulnerabilities Advisory ID: CORE-2016-0002 Advisory URL: http://www.coresecurity.com/advisories/lenovo-shareit-multiple-vulnerabilities Date published: 2016-01-25 Date of last update: 2016-01-22 Vendors contacted: Lenovo Release mode:...

Fortinet FortiOS Information Disclosure Vulnerability (CNVD-2016-00441)

Fortinet FortiOS is a dedicated security operating system on the FortiGate network security platform. Fortinet FortiOS has a FortimanagerAccess account that uses hard-coded passwords, allowing a remote attacker to gain administrator access via an SSH session with the help of this account...

SAP Hybris E-commerce Suite VirtualJDBC - Default Credentials

Application: SAP Hybris E-commerce Suite Versions Affected: SAP Hybris E-commerce Suite 5.1.0.3 Vendor URL: SAP Bugs: Default credentials Reported: 01.02.2016 Vendor response: 02.02.2016 Date of Public Advisory: 10.05.2016 Author: Alexey Tyurin ERPScan VULNERABILITY INFORMATION Class: CWE-259 Use...

Juniper Networks ScreenOS Authentication Bypass (CVE-2015-7755)

An authentication bypass vulnerability exists in Juniper Networks ScreenOS. The vulnerability is due to the presence of a default administrative account with a hard-coded password. A remote, unauthenticated attacker could exploit this vulnerability to gain administrative access to the target...