CVE-2020-13859

An issue was discovered on Mofi Network MOFI4500-4GXeLTE 4.0.8-std devices. A format error in /etc/shadow, coupled with a logic bug in the LuCI - OpenWrt Configuration Interface framework, allows the undocumented system account mofidev to login to the cgi-bin/luci/quick/wizard management interfac...

Mofi Network MOFI4500-4GXeLTE 安全漏洞

The Mofi Network MOFI4500-4GXeLTE is a wireless router from Mofi Network. A security vulnerability exists in the Mofi Network MOFI4500-4GXeLTE 4.0.8-std devices, which can be exploited by an attacker to gain unauthorized access to /systemlog.tar.gz to obtain information such as /etc/shadow and...

PT-2021-7656 · Asus · Asus Rt-Ac68U

Name of the Vulnerable Software and Affected Versions: ASUS RT-AC68U router firmware versions prior to 3.0.0.4.386.41634 Description: The issue is related to a SQL injection vulnerability in the Cloud Disk feature of the ASUS RT-AC68U router firmware. This vulnerability allows remote attackers to...

CVE-2020-29669

In the Macally WIFISD2-2A82 Media and Travel Router 2.000.010, the Guest user is able to reset its own password. This process has a vulnerability which can be used to take over the administrator account and results in shell access. As the admin user may read the /etc/shadow file, the password...

Design/Logic Flaw

In the Macally WIFISD2-2A82 Media and Travel Router 2.000.010, the Guest user is able to reset its own password. This process has a vulnerability which can be used to take over the administrator account and results in shell access. As the admin user may read the /etc/shadow file, the password...

CVE-2020-29669

In the Macally WIFISD2-2A82 Media and Travel Router 2.000.010, the Guest user is able to reset its own password. This process has a vulnerability which can be used to take over the administrator account and results in shell access. As the admin user may read the /etc/shadow file, the password...

broker: resetUsers operation stores password in plain text

A flaw was found in ActiveMQ Artemis management API from version 2.7.0 up until 2.12.0, where a user inadvertently stores passwords in plaintext in the Artemis shadow file etc/artemis-users.properties file when executing the resetUsers operation. A local attacker can use this flaw to read the...

CVE-2020-10727

A flaw was found in ActiveMQ Artemis management API from version 2.7.0 up until 2.12.0, where a user inadvertently stores passwords in plaintext in the Artemis shadow file etc/artemis-users.properties file when executing the resetUsers operation. A local attacker can use this flaw to read the...

CVE-2020-10727

CVE-2020-10727 affects ActiveMQ Artemis management API from version 2.7.0 up to 2.12.0. The root cause is that during the resetUsers operation, passwords are stored in plaintext in the Artemis shadow file (etc/artemis-users.properties), enabling a local attacker to read the shadow file contents. ...

broker: resetUsers operation stores password in plain text

A flaw was found in ActiveMQ Artemis management API from version 2.7.0 up until 2.12.0, where a user inadvertently stores passwords in plaintext in the Artemis shadow file etc/artemis-users.properties file when executing the resetUsers operation. A local attacker can use this flaw to read the...

PT-2020-3006

Name of the Vulnerable Software and Affected Versions ActiveMQ Artemis versions 2.7.0 through 2.12.0 Description A flaw in the ActiveMQ Artemis management API allows a user to inadvertently store passwords in plaintext in the Artemis shadow file etc/artemis-users.properties file when executing th...

CVE-2020-10277

There is no mechanism in place to prevent a bad operator to boot from a live OS image, this can lead to extraction of sensible files such as the shadow file or privilege escalation by manually adding a new user with sudo privileges on the machine...

CVE-2020-10277 RVD#2562: Booting from a live image leads to exfiltration of sensible information and privilege escalation

There is no mechanism in place to prevent a bad operator to boot from a live OS image, this can lead to extraction of sensible files such as the shadow file or privilege escalation by manually adding a new user with sudo privileges on the machine...

CVE-2020-10277: Reliance on Security Through Obscurity

There is no mechanism in place to prevent a bad operator to boot from a live OS image, this can lead to extraction of sensible files such as the shadow file or privilege escalation by manually adding a new user with sudo privileges on the machine...

PT-2020-12026

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided descriptions. Description The issue is related to the lack of a mechanism to prevent booting from a live OS image, which can lead to the extraction of sensitive files, such as the...

PT-2020-22782

Updated sudo packages fix security vulnerabilities: It was found that sudo always allowed commands to be run with unknown user or group ids if the sudo configuration allowed it for example via the "ALL" alias. This could allow sudo to impersonate non-existent account and depending on how...

CVE-2020-13695

In QuickBox Community Edition through 2.5.5 and Pro Edition through 2.1.8, the local www-data user has sudo privileges to execute grep as root without a password, which allows an attacker to obtain sensitive information via a grep of a /root/.db or /etc/shadow file...

sudo: by using ! character in the shadow file instead of a password hash can access to a run as all sudoer account

When an account is disabled via the shadow file, by replacing the password hash with "!", it is not considered disabled by sudo. And depending on the configuration, sudo can be run by using such disabled account...

WAGO PFC100/200 Web-Based Management (WBM) Authentication Timing Information Disclosure Vulnerability

Summary An exploitable timing discrepancy vulnerability exists in the authentication functionality of the Web-Based Management WBM web application on WAGO PFC100/200 controllers. The WBM application makes use of the PHP crypt function which can be exploited to disclose hashed user credentials...

Fedora 31 : sudo (2020-8b563bc5f4)

update to latest development version 1.9.0b1 - added sudologsrvd and sudosendlog to files and their appropriate man pages Resolves: rhbz1787823 - Stack based buffer overflow in when pwfeedback is enabled Resolves: rhbz1796945 - fixes: CVE-2019-18634 - By using ! character in the shadow file...