552 matches found
Authorization
The factory configuration for vMX installations, as shipped, includes default credentials for the root account. Without proper modification of these default credentials by the administrator, an attacker could exploit these credentials and access the vMX instance without authorization. This issue...
[SECURITY] [DLA 2163-1] tinyproxy security update
Package : tinyproxy Version : 1.8.3-3+deb8u1 CVE ID : CVE-2017-11747 Debian Bug : 870307 948283 A minor security issue and a severe packaging bug have been fixed in tinyproxy, a lightweight http proxy daemon. CVE-2017-11747 main.c in Tinyproxy created a /var/run/tinyproxy/tinyproxy.pid file after...
Authentication flaw
An Authentication Bypass Vulnerability exists in DELL SonicWALL Analyzer 7.0, Global Management System GMS 4.1, 5.0, 5.1, 6.0, and 7.0; Universal Management Appliance UMA 5.1, 6.0, and 7.0 and ViewPoint 4.1, 5.0, 5.1, and 6.0 via the skipSessionCheck parameter to the UMA interface /appliance/,...
CVE-2013-1359
An Authentication Bypass Vulnerability exists in DELL SonicWALL Analyzer 7.0, Global Management System GMS 4.1, 5.0, 5.1, 6.0, and 7.0; Universal Management Appliance UMA 5.1, 6.0, and 7.0 and ViewPoint 4.1, 5.0, 5.1, and 6.0 via the skipSessionCheck parameter to the UMA interface /appliance/,...
CVE-2019-18828
Barco ClickShare Button R9861500D01 devices before 1.9.0 have Insufficiently Protected Credentials. The root account present for access via debug interfaces, which are by default not enabled on production devices of the embedded Linux on the ClickShare Button is using a weak password...
CVE-2019-15015
In the Zingbox Inspector, versions 1.294 and earlier, hardcoded credentials for root and inspector user accounts are present in the system software, which can result in unauthorized users gaining access to the system...
CVE-2019-5534
VMware vCenter Server 6.7.x prior to 6.7 U3, 6.5 prior to 6.5 U3 and 6.0 prior to 6.0 U3j contains an information disclosure vulnerability where Virtual Machines deployed from an OVF could expose login information via the virtual machine's vAppConfig properties. A malicious actor with access to...
CVE-2019-13477
In CentOS-WebPanel.com aka CWP CentOS Web Panel 0.9.8.837, CSRF in the forgot password function allows an attacker to change the password for the root account...
CVE-2019-13477
In CentOS-WebPanel.com aka CWP CentOS Web Panel 0.9.8.837, CSRF in the forgot password function allows an attacker to change the password for the root account...
PT-2019-4343 · Centos · Centos Web Panel
Name of the Vulnerable Software and Affected Versions: CentOS Web Panel version 0.9.8.837 Description: The issue concerns a CSRF vulnerability in the forgot password function, allowing an attacker to change the password for the root account. This vulnerability can be exploited by a remote attacke...
Design/Logic Flaw
Neet AirStream NAS1.1 devices have a password of ifconfig for the root account. This cannot be changed via the configuration page...
CVE-2017-18449
cPanel before 64.0.21 allows certain file-rename operations in the context of the root account via scripts/convertroundcubemysql2sqlite SEC-254...
Code injection
cPanel before 62.0.17 allows code execution in the context of the root account via a long DocumentRoot path SEC-225...
Code injection
cPanel before 64.0.21 allows certain file-rename operations in the context of the root account via scripts/convertroundcubemysql2sqlite SEC-254...
CVE-2017-18449
CVE-2017-18449 affects cPanel prior to 64.0.21. The issue enables certain file-rename operations in the context of the root account via scripts/convert_roundcube_mysql2sqlite (SEC-254). The vulnerability is caused by insufficient validation of file rename actions within the specified script path,...
Code injection
cPanel before 64.0.21 allows code execution in the context of the root account via a SETVHOSTLANGPACKAGE multilang adminbin call SEC-237...
CVE-2017-18434
CVE-2017-18434 affects cPanel prior to 64.0.21. The vulnerability allows code execution in the root account context via a SET_VHOST_LANG_PACKAGE multilang adminbin call (SEC-237). The provided connected Red Hat/CNVD/EUVD/PRION/CVE records corroborate the same core issue and describe the root caus...
Code injection
cPanel before 68.0.15 allows code execution in the context of the root account because of weak permissions on incremental backups SEC-322...