Arbitrary Password Change Vulnerability in DCFW-1800-WAF-LAB

DCFW-1800 series next-generation firewalls can accurately identify thousands of network applications and provide detailed application risk analysis and flexible policy control. DCFW-1800-WAF-LAB suffers from an arbitrary password change vulnerability, which can be exploited by an attacker to chan...

Change your password: Docker suffers breach; 190k users affected

By Uzair Amir Microsoft says its official Microsoft images hosted in Docker Hub have not been compromised. The company behind Docker, a computer program developed to manage operating-system-level virtualization has announced that it has suffered a data breach and as a result, one of Docker Hub...

A week in security (April 22 – 28)

Last week on Labs, we looked at security threats to headphones, privacy options in the world of law, and wandered through the FBI’s 2018 IC3 online crime report. We also explored another MageCart attack, and we released our 2019 Q1 Crime Tactics and Techniques report. Other cybersecurity news...

Docker Hub Hack Affects 190K Accounts, with Concerning Consequences

UPDATE Docker Hub has confirmed that it was hacked last week; with sensitive data from approximately 190,000 accounts potentially exposed. “On Thursday, April 25th, 2019, we discovered unauthorized access to a single Hub database storing a subset of non-financial user data,” Kent Lamb, director o...

Unauthorized Access Vulnerability in Firewall DCFOS of Beijing Digital China Cloud Computing Information Technology Co.

Ltd. is a professional company with its own network and cloud brand and intellectual property rights under the Digital China Group, and is a network and cloud equipment and solution provider involved in IPv6. An unauthorized access vulnerability exists in the firewall DCFOS of Digital China Cloud...

Sierra #Wireless #AirLink ES450 #ACEManager upload.cgi Unverified Password Change Exploit

Exploit for hardware platform in category web applications...

Sierra Wireless AirLink ES450 Unauthorized Password Change Vulnerability

The Sierra Wireless AirLink ES450 is a cellular network modem device from Sierra Wireless Canada. An unauthorized password change vulnerability exists in the ACEManager upload.cgi function in the Sierra Wireless AirLink ES450 using firmware version 4.9.3, which can be exploited by an attacker to...

Sierra Wireless AirLink ES450 Privilege Permission and Access Control Issues Vulnerability

The Sierra Wireless AirLink ES450 is a cellular network modem device from Sierra Wireless Canada. A security vulnerability exists in the ACEManager EmbeddedAceSetTask.cgi function in the Sierra Wireless AirLink ES450 using firmware version 4.9.3. An attacker can exploit the vulnerability by sendi...

Sierra Wireless AirLink ES450 ACEManager upload.cgi Unverified Password Change

Talos Vulnerability Report TALOS-2018-0749 Sierra Wireless AirLink ES450 ACEManager upload.cgi Unverified Password Change Vulnerability April 25, 2019 CVE Number CVE-2018-4064 Summary An exploitable unverified password change vulnerability exists in the ACEManager upload.cgi functionality of Sier...

CVE-2018-16219

A missing password verification in the web interface in AudioCodes 405HD VoIP phone with firmware 2.2.12 allows an remote attacker in the same network as the device to change the admin password without authentication via a POST request...

Vulnerability Spotlight: Multiple vulnerabilities in Sierra Wireless AirLink ES450

Carl Hurd and Jared Rittle of Cisco Talos discovered these vulnerabilities. Executive summary Several exploitable vulnerabilities exist in the Sierra Wireless AirLink ES450, an LTE gateway designed for distributed enterprise, such as retail point-of-sale or industrial control systems. These flaws...

Sierra Wireless AirLink ES450 ACEManager upload.cgi Unverified Password Change Vulnerability

Summary An exploitable unverified password change vulnerability exists in the ACEManager upload.cgi functionality of Sierra Wireless AirLink ES450 FW 4.9.3. A specially crafted HTTP request can cause a unverified device configuration change, resulting in an unverified change of the user password ...

CVE-2019-11414

An issue was discovered on Intelbras IWR 3000N 1.5.0 devices. When the administrator password is changed from a certain client IP address, administrative authorization remains available to any client at that IP address, leading to complete control of the router...

CVE-2019-11393

An issue was discovered in /admin/users/update in M/Monit before 3.7.3. It allows unprivileged users to escalate their privileges to an administrator by requesting a password change and specifying the admin parameter...

Default credentials

An issue was discovered in /admin/users/update in M/Monit before 3.7.3. It allows unprivileged users to escalate their privileges to an administrator by requesting a password change and specifying the admin parameter...

M/Monit Elevation of Privilege Vulnerability

M/Monit monitors and manages distributed computer systems, performs automated maintenance and remediation, and performs meaningful causal behavior in the event of an error. An elevation of privilege vulnerability exists in /admin/users/update in versions of M/Monit prior to 3.7.3. An unprivileged...

CVE-2019-11393

An issue was discovered in /admin/users/update in M/Monit before 3.7.3. It allows unprivileged users to escalate their privileges to an administrator by requesting a password change and specifying the admin parameter...

Read the Mueller Report; Change Your Instagram Password

Catch up on the most important news today in 2 minutes or less...

Design/Logic Flaw

When "set system ports console insecure" is enabled, root login is disallowed for Junos OS as expected. However, the root password can be changed using "set system root-authentication plain-text-password" on systems booted from an OAM Operations, Administration, and Maintenance volume, leading to...

CVE-2019-0035

CVE-2019-0035 describes an administrative bypass on Juniper Networks Junos OS. When the insecure console port setting is enabled, an attacker with physical access can change the root password on systems booted from an OAM volume using the command set system root-authentication plain-text-password...