Hardcoded credentials

The init script in the Gentoo app-admin/logstash-bin package before 5.5.3 and 5.6.x before 5.6.1 has "chown -R" calls for user-writable directory trees, which allows local users to gain privileges by leveraging access to a $LSUSER account for creation of a hard link...

CVE-2015-4667

Multiple hardcoded credentials in Xsuite 2.x...

CVE-2015-4667

CVE-2015-4667 affects Xceedium Xsuite 2.x (notably versions 2.3.0 and 2.4.3.0). The connected documents describe multiple hardcoded credentials vulnerabilities, including a hard-coded database password (n1b2dy) and broader issues in Xsuite 2.x that enable remote/ local access. Additional related ...

PT-2017-6779

Name of the Vulnerable Software and Affected Versions Xsuite versions 2.x Description The issue concerns multiple hardcoded credentials. Recommendations For Xsuite versions 2.x, update to a version where the hardcoded credentials issue is resolved, or as a temporary workaround, consider changing...

CVE-2015-4667: Use of Hard-coded Credentials

Multiple hardcoded credentials in Xsuite 2.x...

Hardcoded credentials

A Use of Hard-Coded Cryptographic Key issue was discovered in Mirion Technologies DMC 3000 Transmitter Module, iPam Transmitter f/DMC 2000, RDS-31 iTX and variants including RSD31-AM Package, DRM-1/2 and variants including Solar PWR Package, DRM and RDS Based Boundary Monitors, External...

Hardcoded credentials

The getUserzoneCookie function in Kaltura before 13.2.0 uses a hardcoded cookie secret to validate cookie signatures, which allows remote attackers to bypass an intended protection mechanism and consequently conduct PHP object injection attacks and execute arbitrary PHP code via a crafted userzon...

Hardcoded credentials

D-Link DIR-850L REV. A with firmware through FW114WWb07h2abbeta1 and REV. B with firmware through FW208WWb02 devices use the same hardcoded /etc/stunnel.key private key across different customers' installations, which allows remote attackers to defeat the HTTPS cryptographic protection mechanisms...

Hardcoded credentials

D-Link DIR-850L REV. A with firmware through FW114WWb07h2abbeta1 and REV. B with firmware through FW208WWb02 devices have 0666 /var/etc/hnapasswd permissions...

CVE-2017-14421: Use of Hard-coded Credentials

D-Link DIR-850L REV. B with firmware through FW208WWb02 devices have a hardcoded password of wrgac25dlink.2013guidir850l for the Alphanetworks account upon device reset, which allows remote attackers to obtain root access via a TELNET session...

Hardcoded credentials

Honda Moto LINC 1.6.1 does not verify SSL certificates...

Security Vulnerabilities in AT&T Routers

They're actually Arris routers, sold or given away by AT&T.; There are several security vulnerabilities, some of them very serious. They can be fixed, but because these are routers it takes some skill. We don't know how many routers are affected, and estimates range from thousands to 138,000. Amo...

PT-2017-3366

Name of the Vulnerable Software and Affected Versions Zivif PR115-204-P-RS versions prior to a version with a fixed password for the root user Description The issue is related to the use of hardcoded credentials, specifically a password cat1029 for the root user, which cannot be changed due to th...

AT&T U-verse Arris Modems NVG589 / NVG599 / 5268AC Multiple Vulnerabilities (SharknATTo)

The remote Arris device's self report model is NVG589, NVG599 or 5268AC. It is, therefor, affected by multiple vulnerabilities, including a firewall bypass, multiple instances of hardcoded credentials, privilege escalation, and remote code execution. Note: Nessus has not checked the firmware...

Bugs in Arris Modems Distributed by AT&T Vulnerable to Trivial Attacks

Trivially exploitable vulnerabilities have been discovered in several Arris home modems, routers and gateways distributed to consumers and small businesses through AT&T’s U-verse service. It’s unknown yet whether the firmware vulnerabilities were introduced by the OEM or the ISP since AT&T seems ...

Hardcoded credentials

In The Sleuth Kit TSK 4.4.2, fls hangs on a corrupt exfat image in tskimgread in tsk/img/imgio.c in libtskimg.a...

Philips' DoseWise Portal Hardcoding Vulnerability

Philips' DoseWise Portal is a web-based reporting and tracking tool for radiation exposure. A hard-coded vulnerability exists in Philips' DoseWise Portal. An attacker exploiting this vulnerability would first require elevated privileges in order for the attacker to access web application back-end...

Orange Aliyun OSS credentials suffer from information leakage vulnerability

Orange APP is an erotic community app. AliCloud Object Storage ServiceObject Storage Service, or OSS for short, is a massive, secure and highly reliable cloud storage service provided by AliCloud to the public. There is an information leakage vulnerability in the Orange Aliyun OSS credentials. Th...

Hardcoded credentials

DISPUTED An Incorrect Password Management issue was discovered in SMA Solar Technology products. Default passwords exist that are rarely changed. User passwords will almost always be default. Installer passwords are expected to be default or similar across installations installed by the same...

Hardcoded credentials

MaLion for Windows and Mac versions 3.2.1 to 5.2.1 uses a hardcoded cryptographic key which may allow an attacker to alter the connection settings of Terminal Agent and spoof the Relay Service...