SMA Solar Technology inverter weak password vulnerability (CNVD-2017-27842)

SMA Solar Technology inverter is a photovoltaic inverter device from SMA Germany. A weak password vulnerability exists in the SMA Solar Technology inverter, which stems from a weak password policy used by the program and can be exploited by an attacker to obtain a password...

Default credentials

DISPUTED An issue was discovered in SMA Solar Technology products. All inverters have a very weak password policy for the user and installer password. No complexity requirements or length requirements are set. Also, strong passwords are impossible due to a maximum of 12 characters and a limited s...

CVE-2017-9853

An issue was discovered in SMA Solar Technology products. All inverters have a very weak password policy for the user and installer password. No complexity requirements or length requirements are set. Also, strong passwords are impossible due to a maximum of 12 characters and a limited set of...

CVE-2017-9853

An issue was discovered in SMA Solar Technology products. All inverters have a very weak password policy for the user and installer password. No complexity requirements or length requirements are set. Also, strong passwords are impossible due to a maximum of 12 characters and a limited set of...

CVE-2017-9853

SMA Solar Technology inverters (Sunny Boy TLST-21/TL-21 and Sunny Tripower TL-10/TL-30) are affected by a weak password policy: no complexity or length requirements and a maximum 12-character limit, making strong passwords impossible. The CVE details state that this could allow password-related a...

PT-2017-19219 · Sma Solar Technology · Sunny Tripower +2

Name of the Vulnerable Software and Affected Versions: SMA Solar Technology products affected versions not specified Sunny Boy versions TLST-21 and TL-21 Sunny Tripower versions TL-10 and TL-30 Description: An issue was discovered in SMA Solar Technology products, where all inverters have a weak...

IBM API Connect and API Management Security Bypass Vulnerability

IBM API Connect and API Management are both products of IBM Corporation in the U.S. IBM API Connect also known as APIConnect is a set of integrated solutions for managing the API lifecycle.API Management is a set of API management platforms from IBM Corporation in the U.S.. A security bypass...

WakaTime: Failure to check password history

I discovered that old passwords could be reused and believe that wakatime.com could benefit if there was a check for old passwords in your database. Because password reuse is an important concern in any organization. Many users want to reuse the same password for their account over a long period ...

WakaTime: Password Policy Issue

Greetings Wakatime, I just found a weak password policy in your login page. Some websites prevents the users to use password constructed of character combinations that otherwise meet company policy, but should no longer be used because they have been deemed insecure for one or more reasons, such ...

AWS Auditing & Hardening Tool: Zeus

Zeus is a powerful tool for AWS EC2 / S3 / CloudTrail / CloudWatch / KMS best hardening practices. It checks security settings according to the profiles the user creates and changes them to recommended settings based on the CIS AWS Benchmark source at request of the user. Identity and Access...

CVE-2017-7903

A Weak Password Requirements issue was discovered in Rockwell Automation Allen-Bradley MicroLogix 1100 programmable-logic controllers 1763-L16AWA, Series A and B, Version 16.00 and prior versions; 1763-L16BBB, Series A and B, Version 16.00 and prior versions; 1763-L16BWA, Series A and B, Version...

IBM BigFix Security Compliance Analytics Weak Default Password Vulnerability

IBM BigFix Security Compliance Analytics is a suite of systems management software from IBM in the United States. The software provides remote control, patch management, software distribution, operating system deployment, network access protection and other functions. A security vulnerability...

Why you have to move beyond “We have a policy for that”

Ive never been a big fan of - or have believed in the value of - security policies. Sure, theyre necessary for setting expectations and auditors want to see them. They can also serve as a sort of insurance policy to fall back on when an unexpected security "event" occurs. But, at the end of the...

IBM BigFix Compliance 1.9.70 Multiple Vulnerabilities

According to its self-reported version, the instance of IBM BigFix Compliance running on the remote web server is 1.9.70. It is, therefore, affected by multiple vulnerabilities : - A stored cross-site scripting XSS vulnerability exists in the Analytics component in the Web UI due to improper...

Yelp: Weak Password Policy

Summary your website allowing users to set their password to simple, at this time, i can set my password to 123456 Determine the resistance of the application against brute force password guessing using available password dictionaries by evaluating the length, complexity, reuse and aging...

Brocade Fibre Channel SAN Privilege Escalation - us

Lenovo Security Advisory: LEN-14794 Potential Impact: Local privilege escalation Severity: High Scope of Impact: Industry-Wide CVE Identifier: CVE-2016-8202 Summary Description: A privilege escalation vulnerability in Brocade Fibre Channel SAN products running Brocade Fabric OS FOS releases earli...

Teradici: Weak Password Policy on techsupport.teradici.com

techsupport.teradici.com had a weak password requirement, which is now fixed with complex password requirement...

pwdlyser - Python-based CLI Password Analyser (Reporting Tool)

The 'pwdlyser' tool is a Python-based CLI script that automates the arduous process of manually reviewing cracked passwords during password audits following security assessments or penetration tests. There are likely some false positives/negatives, so please use at your own discretion. Installati...

Legal Robot: Password Policy Bypass

Hi LegalRobot team, I noticed that there is a strong Password policy enforced on login page which only allows passwords with 8 or more characters and they need to be a combination of Capital letters, small letters, and numbers/special characters. However i found that i am able to bypass this...

CVE-2016-8379

An issue was discovered in Moxa ioLogik E1210, firmware Version V2.4 and prior, ioLogik E1211, firmware Version V2.3 and prior, ioLogik E1212, firmware Version V2.4 and prior, ioLogik E1213, firmware Version V2.5 and prior, ioLogik E1214, firmware Version V2.4 and prior, ioLogik E1240, firmware...