Sonatype Nexus Repository Manager Weak Password Vulnerability

Sonatype Nexus Repository Manager NXRM is a Maven repository manager from Sonatype USA. A security vulnerability exists in Sonatype NXRM versions prior to 3.17.0, which stems from the default administrator account password being set to admin/admin123, which can be exploited by an attacker to gain...

CVE-2018-11421

Moxa OnCell G3100-HSPA Series version 1.6 Build 17100315 and prior use a proprietary monitoring protocol that does not provide confidentiality, integrity, and authenticity security controls. All information is sent in plain text, and can be intercepted and modified. The protocol is vulnerable to...

Weak password vulnerability in Qiji O&M system software

Qiji Technology is a product-based company founded by O&M management experts and focused on O&M operations. Qiji operation and maintenance management system software has a weak password vulnerability, which can be exploited to obtain information about the backend server and manage the bastion...

CWCMS of Henan Netflag Pioneer Network Technology Co., Ltd. suffers from universal password login vulnerability

CWCMS is a set of customized ASP+Access/MsSql program specially designed for corporate websites. Henan Netflag Pioneer Network Technology Co., Ltd CWCMS has a universal password login vulnerability. An attacker can use this vulnerability to obtain sensitive information...

PlaintextPasswordEncoder authenticates encoded passwords that are null

Spring Security, versions 4.2.x up to 4.2.12, and older unsupported versions support plain text passwords using PlaintextPasswordEncoder. If an application using an affected version of Spring Security is leveraging PlaintextPasswordEncoder and a user has a null encoded password, a malicious user ...

@troveng/trov-web-config (=1.0.5), @zce/ghost-cli (>=1.9.7 <=1.9.8) +13 more potentially affected by unknown CVE via generate-password (>=1.3.0 <=1.4.0)

generate-password NPM version =1.3.0, =1.9.7, =1.0.2, =1.16.0, =0.1.4, =0.1.11, =1.4.0, =0.6.0, =0.9.11, =0.0.2, =1.6.0, =4.20.9, =0.9.0, =1.0.79, =1.4.0, =1.11.0 Source cves: unknown CVE Source advisory: OSV:GHSA-6QQF-VVCR-7QRV...

Best password managers for 2019

By Zehra Ali If you use the Internet, password managers should be a part of your online life as users are at high risk of cybercrime in this digital and technological era. Hackers are always looking for a way to access sensitive data of the vulnerable individual, and unfortunately, weak passwords...

Zyxel NAS 326 Plaintext Password Vulnerability

The Zyxel NAS 326 is a two-drive personal cloud storage device from Zyxel Hopscotch. A plaintext password vulnerability exists in Zyxel NAS 326 version 5.21 and earlier. A user with elevated privileges can exploit the vulnerability to obtain the administrator password of the device...

Privilege escalation

In Airsonic 10.2.1, RecoverController.java generates passwords via org.apache.commons.lang.RandomStringUtils, which uses java.util.Random internally. This PRNG has a 48-bit seed that can easily be bruteforced, leading to trivial privilege escalation attacks...

CVE-2019-10908

In Airsonic 10.2.1, RecoverController.java generates passwords via org.apache.commons.lang.RandomStringUtils, which uses java.util.Random internally. This PRNG has a 48-bit seed that can easily be bruteforced, leading to trivial privilege escalation attacks...

CVE-2019-10011

CVE-2019-10011 affects Jenzabar JICS (Internet Campus Solution): ICS/StaticPages/AddTestUsers.aspx allows remote account creation with a password of 1234 prior to 2019-02-06. Connected sources (Red Hat, NVD, CVE lists) corroborate the same description. The documentation does not provide a patch v...

CVE-2018-17956

CVE-2018-17956 affects the yast2-samba-provision component. Up to and including version 1.0.1, it leaked Samba-share passwords by passing them on the command line to tools used by yast2-samba-provision, enabling local attackers to read credentials in the process list. Several connected advisories...

CVE-2018-20106 SMB printer settings don't escape characters in passwords properly

In yast2-printer up to and including version 4.0.2 the SMB printer settings don't escape characters in passwords properly. If a password with backticks or simliar characters is supplied this allows for executing code as root. This requires tricking root to enter such a password in yast...

Arbitrary Password Change Vulnerability in Zhi Rui Elementary and Middle School Students' School Registration Information Management System

Zhirui Elementary and Middle School Students' School Registration Information Management System is an information system that collects students' basic information and reports it to the education administration department. There is an arbitrary password change vulnerability in Zhirui Elementary an...

WSD-T13 Cloud Storage Camera with Override Add Vulnerability

Ltd. is an enterprise specializing in the research and development, production, sales and service of security monitoring products. WSD-T13 Cloud Storage Camera has an override add vulnerability. The vulnerability is due to the manufacturer's use of the default password. Allows attackers to exploi...

CVE-2019-7674

The CVE concerns MOBOTIX S14 MX-V4.2.1.61 devices where the /admin/access endpoint accepts a request to set the password to a fixed value (the string “aaaaa”). This represents an authentication weakness enabling password change by an authorized or potentially any user, depending on access control...

Mogul Interactive website builder system backstage login page has a universal password login vulnerability

Xi'an Mogul Interactive Technology Co., Ltd. is to provide a series of services for enterprises from website building analysis, web design, website optimization and so on. There is a universal password login vulnerability in the background login page of Mogul Interactive website builder system,...

CVE-2018-18871

Missing password verification in the web interface on Gigaset Maxwell Basic VoIP phones with firmware 2.22.7 would allow a remote attacker in the same network as the device to change the admin password without authentication and without knowing the original password...

Weak Password Vulnerability in Vimeo Interactive Website Management System

Chengdu Vimeo Interactive Network Technology Co., Ltd. is a technology company whose main products or services are all kinds of website construction, space domain name. Weak password vulnerability exists in the website management system of Weimei Interactive, which can be exploited by attackers t...

Weak Password Vulnerability in Byzoro PatrolFlow Multiservice Security Gateway

PatrolFlow is a multi-service security gateway intelligent management platform of Beijing Byzoro Network Technology Co. Byzoro PatrolFlow multi-service security gateway has a weak password vulnerability. An attacker can use the vulnerability to log in to the system and take over the entire networ...