CVE-2023-51741 Cleartext Submission of Password vulnerability in Skyworth Router

This vulnerability exist in Skyworth Router CM5100, version 4.1.1.24, due to transmission of authentication credentials in plaintext over the network. A remote attacker could exploit this vulnerability by eavesdropping on the victim’s network traffic to extract username and password from the web...

CVE-2023-51740 Cleartext Submission of Password vulnerability in Skyworth Router

This vulnerability exist in Skyworth Router CM5100, version 4.1.1.24, due to transmission of authentication credentials in plaintext over the network. A remote attacker could exploit this vulnerability by eavesdropping on the victim’s network traffic to extract username and password from the web...

CVE-2023-51740 Cleartext Submission of Password vulnerability in Skyworth Router

This vulnerability exist in Skyworth Router CM5100, version 4.1.1.24, due to transmission of authentication credentials in plaintext over the network. A remote attacker could exploit this vulnerability by eavesdropping on the victim’s network traffic to extract username and password from the web...

CVE-2023-49253

Root user password is hardcoded into the device and cannot be changed in the user interface...

Weak Password Vulnerability in KingPortal Development System of Beijing Asia Control Technology Development Co.

Beijing Asian Control Technology Development Co., Ltd. is a high-tech enterprise of automation software platform. A weak password vulnerability exists in the KingPortal development system of Beijing Asian Control Technology Development Co., Ltd, which can be exploited by attackers to obtain...

Engineers Online Portal Security Breach

Engineers Online Portal is open source an online portal . It is developed using PHP, MySQL database, HTML, CSS, Javascript, jQuery, Ajax, Bootstrap and some other libraries. A security vulnerability exists in Engineers Online Portal version 1.0, which stems from the parameter Password in the file...

The vulnerability of corporate managers’ passwords in Passwork, related to deficiencies in authentication procedures, allows attackers to bypass two-factor authentication (2FA).

The vulnerability of corporate managers’ passwords in Passwork is related to deficiencies in authentication procedures. Exploiting this vulnerability allows a malicious actor to bypass two-factor authentication by obtaining a one-time six-digit code...

PT-2024-13707 · Gradle · Gradle Enterprise

Name of the Vulnerable Software and Affected Versions: Gradle Enterprise versions prior to 2023.1 Description: A remote attacker may gain access to a new installation of Gradle Enterprise in certain scenarios due to a non-unique initial system user password. Although this password must be changed...

CVE-2024-0281

A vulnerability was found in Kashipara Food Management System up to 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file loginCheck.php. The manipulation of the argument password leads to sql injection. The attack may be launched remotely. The exploit h...

Easy File Sharing FTP Server 2.0 Denial Of Service Exploit

!/usr/bin/perl use Net::FTP; Exploit Title: Easy File Sharing FTP Server 2.0 - Denial of Service DoS Discovery by: Fernando Mengali Discovery Date: 04 january 2024 Download to demo: https://drive.google.com/drive/folders/1XISgBk4Zql8NzkWsrzAPOUEqbjJP4hZQ?usp=sharing Notification vendor: No report...

CVE-2023-28616

An issue was discovered in Stormshield Network Security SNS before 4.3.17, 4.4.x through 4.6.x before 4.6.4, and 4.7.x before 4.7.1. It affects user accounts for which the password has an equals sign or space character. The serverd process logs such passwords in cleartext, and potentially sends...

Weak Password Vulnerability in MSG3100 at Resconda Technology Development Co.

MSG3100 is a box-type IP PBX product for government and enterprise customers, applicable to enterprises with less than 300 people, adopting 1U box-type design, used at the interface between enterprise internal network and access network, to meet the business needs of enterprise voice and data...

Connectize G6 AC2100 Security Vulnerability

The Connectize G6 AC2100 is a wireless router from Connectize. A security vulnerability exists in the Connectize G6 AC2100 version 641.139.1.1256, which stems from the presence of a cross-site scripting XSS vulnerability. The vulnerability can be exploited by an attacker to run arbitrary code via...

CVE-2023-49040

An issue in Tneda AX1803 v.1.0.0.1 allows a remote attacker to execute arbitrary code via the adslPwd parameter in the formfastsettinginternetset function...

Red Lion Controls Crimson Security Vulnerability

Red Lion Controls Crimson is a suite of HMI programming software from Red Lion Controls. A security vulnerability exists in the Red Lion Controls Crimson 3.2 Windows-based configuration tool that could allow an attacker with administrative access to define a new password for a user and download a...

HCL Technologies Compass 安全漏洞

HCL Technologies Compass is a low-code change management software from HCL Technologies, USA. Manages the full range of testing activities and integration with developer tools. HCL Technologies Compass suffers from a weak password vulnerability that stems from susceptibility to insecure password...

Nextcloud Security Breach

Nextcloud is an open source suite of self-hosted file synchronization and sharing communication application platform from Nextcloud, Germany. A security vulnerability exists in Nextcloud Server that stems from allowing an attacker to brute-force break passwords on the WebDAV API. Affected product...

D-Link DIR-823G Password Parameter Buffer Overflow Vulnerability

The D-Link DIR-823G is a wireless router from China's AUO D-Link. A buffer overflow vulnerability exists in the D-Link DIR-823G Password parameter due to incorrect boundary checking in the SetWanSettings function. An attacker could exploit this vulnerability to cause a denial of service...

Command injection

Netis N3Mv2-V1.0.1.865 was discovered to contain a command injection vulnerability in the Changing Username and Password function. This vulnerability is exploited via a crafted payload...

CVE-2023-41322

GLPI stands for Gestionnaire Libre de Parc Informatique is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. A user with write access to another user can make requests to change the latter's password and then take...