CVE-2019-19033

Jalios JCMS 10 allows attackers to access any part of the website and the WebDAV server with administrative privileges via a backdoor account, by using any username and the hardcoded dev password...

PT-2019-15764

Name of the Vulnerable Software and Affected Versions Jalios JCMS version 10 Description The issue allows attackers to access any part of the website and the WebDAV server with administrative privileges via a backdoor account. This is achieved by using any username and a hardcoded dev password...

Hardcoded credentials

Brocade SANnav versions before v2.0 use a hard-coded password, which could allow local authenticated attackers to access a back-end database and gain privileges...

Cisco Small Business RV016, RV042, RV042G, and RV082 Routers Issues

Cisco firmware for certain Cisco Small Business RV Series Routers is affected by the following issues: Certificate and key issued to QNO Technology Hardcoded password hashes Multiple vulnerabilities in third-party software TPS components Certificate and Key Issued to QNO Technology An X.509...

Cisco Small Business RV320 and RV325 Dual Gigabit WAN Routers Issues

Cisco firmware for Cisco RV320 and RV325 Dual Gigabit WAN VPN Routers is affected by the following issues: Static certificates and keys Hardcoded password hashes Multiple vulnerabilities in third-party software TPS components Static Certificates and Keys Two static X.509 certificates with the...

PT-2019-3130

Name of the Vulnerable Software and Affected Versions Cisco Small Business RV160, RV260, and RV340 affected versions not specified Description The issue is related to the use of hardcoded password hashes for users root, debug-admin, cisco, admin, and guest. This could allow a remote attacker to...

CVE-2019-15867

The slick-popup plugin before 1.7.2 for WordPress has a hardcoded OmakPass13 password for the slickpopupteam account, after a Subscriber calls a certain AJAX action...

CVE-2019-15867

The slick-popup plugin before 1.7.2 for WordPress has a hardcoded OmakPass13 password for the slickpopupteam account, after a Subscriber calls a certain AJAX action...

CVE-2019-15867

The slick-popup plugin before 1.7.2 for WordPress has a hardcoded OmakPass13 password for the slickpopupteam account, after a Subscriber calls a certain AJAX action...

CVE-2019-15867

The CVE-2019-15867 issue affects the WordPress slick-popup plugin (pre-1.7.2). It relies on a hardcoded credential OmakPass13# for the slickpopupteam account, enabling privilege escalation via a specific AJAX action (as described by connected sources). Practical impact is administrator-level acce...

CVE-2019-15867

The slick-popup plugin before 1.7.2 for WordPress has a hardcoded OmakPass13 password for the slickpopupteam account, after a Subscriber calls a certain AJAX action...

PT-2019-14446

Name of the Vulnerable Software and Affected Versions slick-popup plugin versions prior to 1.7.2 Description The issue concerns a hardcoded password, specifically OmakPass13, for the slickpopupteam account in the slick-popup plugin. This password can be accessed after a Subscriber initiates a...

CVE-2016-10928

The onelogin-saml-sso plugin before 2.2.0 for WordPress has a hardcoded @@@nopass@@@ password for just-in-time provisioned users...

CVE-2016-10928

The onelogin-saml-sso plugin before 2.2.0 for WordPress has a hardcoded @@@nopass@@@ password for just-in-time provisioned users...

CVE-2016-10928

The onelogin-saml-sso plugin before 2.2.0 for WordPress has a hardcoded @@@nopass@@@ password for just-in-time provisioned users...

CVE-2016-10928

The onelogin-saml-sso plugin before 2.2.0 for WordPress has a hardcoded @@@nopass@@@ password for just-in-time provisioned users...

PT-2019-7724

Name of the Vulnerable Software and Affected Versions onelogin-saml-sso plugin versions prior to 2.2.0 Description The issue concerns a hardcoded password @@@nopass@@@ used for just-in-time provisioned users. Recommendations For versions prior to 2.2.0, update to version 2.2.0 or later to resolve...

Fortinet FortiRecorder 2.7.3 Hardcoded Password Vulnerability

Fortinet FortiRecorder 2.7.3 Hardcoded Password Vulnerability Original posting: https://xor.cat/2019/08/05/fortinet-fortirecorder-hardcoded-password/ Text archive available here: https://xor.cat/archive/2019/08/05/fortinet-fortirecorder-hardcoded-password.txt Background In June of 2019 I discover...

PT-2019-7658

Name of the Vulnerable Software and Affected Versions Neet AirStream NAS version 1.1 Description The issue concerns a hardcoded password for the root account, which is set to ifconfig. This password cannot be changed through the configuration page, posing a security risk. Recommendations For Neet...

Fortinet FortiRecorder 2.7.3 Hardcoded Password

Original posting: https://xor.cat/2019/08/05/fortinet-fortirecorder-hardcoded-password/ Text archive available here: https://xor.cat/archive/2019/08/05/fortinet-fortirecorder-hardcoded-password.txt Background In June of 2019 I discovered a vulnerability in Fortinet's FortiRecorder1 product which...