Telnet Backdoor Opens More Than 1M IoT Radios to Hijack

Imperial Dabman IoT radios have a weak password vulnerability that could allow a remote attacker to achieve root access to the gadgets’ embedded Linux BusyBox operating system, gaining control over the device. Adversaries can deliver malware, add a compromised radio to a botnet, send custom audio...

Cisco Device Hardcoded Credentials / GNU glibc / BusyBox

SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Multiple vulnerabilities product: Cisco RV340, Cisco RV340W, Cisco RV345, Cisco RV345P, Cisco RV260, Cisco RV260P, Cisco RV260W, Cisco 160, Cisco 160W vulnerable version:...

Hardcoded credentials

The slick-popup plugin before 1.7.2 for WordPress has a hardcoded OmakPass13 password for the slickpopupteam account, after a Subscriber calls a certain AJAX action...

PT-2019-20350

Уязвимость веб-интерфейса серверного приложение для управления предприятием пищевой промышленности AK-EM 800 связана с использованием жестко закодированных учетных данных пользователей «admin», «administrator», «user» и «guest» с паролем по умолчанию «danfoss». Эксплуатация уязвимости может...

CVE-2019-15867: Use of Hard-coded Credentials

The slick-popup plugin before 1.7.2 for WordPress has a hardcoded OmakPass13 password for the slickpopupteam account, after a Subscriber calls a certain AJAX action...

PT-2019-20351

Уязвимость серверного приложение для управления предприятием пищевой промышленности AK-EM 800 связана с использованием жестко закодированных учетных данных. Эксплуатация уязвимости может позволить нарушителю повысить свои привилегии...

Zyxel NWA/NAP/WAC Hardcoded Credentials

SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Hardcoded FTP Credentials product: Zyxel NWA/NAP/WAC wireless access point series vulnerable version: see "Vulnerable / tested version" fixed version: see "Solution" CVE...

CVE-2019-15745: Use of Hard-coded Credentials

The Eques elf smart plug and the mobile app use a hardcoded AES 256 bit key to encrypt the commands and responses between the device and the app. The communication happens over UDP port 27431. An attacker on the local network can use the same key to encrypt and send commands to discover all smart...

Hardcoded credentials

An issue was discovered in the ammonia crate before 2.1.0 for Rust. There is uncontrolled recursion during HTML DOM tree serialization...

ProGrade/Lierda Grill Temperature 1.00_50006 Hardcoded Credentials

Author: Tim Tepatti Website: tepatti.com Title: Hard-coded credentials on ProGrade/Lierda Grill Temperature Monitor CVE-2019-15304 Product: Grill Temperature Monitor Manufacturer: ProGrade / Lierda Affected Versions: V1.0050006 Tested Versions: V1.0050006 Vulnerability Type: Use of hard-coded...

Hardcoded credentials

The onelogin-saml-sso plugin before 2.2.0 for WordPress has a hardcoded @@@nopass@@@ password for just-in-time provisioned users...

Hardcoded credentials

The google-analyticator plugin before 5.2.1 for WordPress has insufficient HTML sanitization for Google Analytics API text...

Hardcoded credentials

The ninja-forms plugin before 3.0.31 for WordPress has insufficient HTML escaping in the builder...

Siemens SIMATIC HMI Panels and TIA Portal <= v15.1 Update 1 Hardcoded Credentials (ICSA-19-134-09)

Binary data 720274.prm...

Hardcoded credentials

Improper sanitization of HTML in directory names in the Nextcloud Android app prior to version 3.7.0 allowed to style the directory name in the header bar when using basic HTML...

Hardcoded credentials

GNUBOARD5 5.3.1.9 has XSS that allows remote attackers to inject arbitrary web script or HTML via the "mobile board tail contents" parameter, aka the adm/boardformupdate.php bomobilecontenttail parameter...

Hardcoded credentials

GNUBOARD5 5.3.1.9 has XSS that allows remote attackers to inject arbitrary web script or HTML via the "board head contents" parameter, aka the adm/boardformupdate.php bocontenthead parameter...

Hardcoded credentials

GNUBOARD5 5.3.1.9 has XSS that allows remote attackers to inject arbitrary web script or HTML via the "board title contents" parameter, aka the adm/boardformupdate.php bosubject parameter...

CVE-2019-12327

Hardcoded credentials in the Akuvox R50P VoIP phone 50.0.6.156 allow an attacker to get access to the device via telnet. The telnet service is running on port 2323; it cannot be turned off and the credentials cannot be changed...

Hardcoded credentials

Hardcoded credentials in the Akuvox R50P VoIP phone 50.0.6.156 allow an attacker to get access to the device via telnet. The telnet service is running on port 2323; it cannot be turned off and the credentials cannot be changed...