214 matches found
CVE-2017-12317
Summary: The Cisco AMP for Endpoints local vulnerability stems from a static key used to encrypt the connector protection password. Root cause: a static key stored in the application. Impact: an authenticated, local attacker with administrative Windows access can access the static key by stopping...
Cisco AMP for Endpoints Static Key Vulnerability
On October 20th, 2017, Cisco PSIRT was notified by the internal product team of a security vulnerability in the Cisco AMP For Endpoints application that would allow an authenticated, local attacker to access a static key value stored in the local application software. The vulnerability is due to...
Imgur: Remote Code Execution on Git.imgur-dev.com
Hi, Imgur Security Team: I just found that your GitHub Enterprise Serverhttps://git.imgur-dev.com/ didn't patch to the latest version2.8.7. And there is a Rails static key leads to RCE vulnerability! You can see the PoC from my screenshots :...
CVE-2016-9353
An issue was discovered in Advantech SUISAccess Server Version 3.0 and prior. The admin password is stored in the system and is encrypted with a static key hard-coded in the program. Attackers could reverse the admin account password for use...
Hardcoded credentials
An issue was discovered in Advantech SUISAccess Server Version 3.0 and prior. The admin password is stored in the system and is encrypted with a static key hard-coded in the program. Attackers could reverse the admin account password for use...
CVE-2016-9353
An issue was discovered in Advantech SUISAccess Server Version 3.0 and prior. The admin password is stored in the system and is encrypted with a static key hard-coded in the program. Attackers could reverse the admin account password for use...
CVE-2016-9353
CVE-2016-9353 affects Advantech SUSIAccess Server (3.0 and earlier). The admin password is stored on the system and encrypted with a static, hard-coded key, enabling reverse retrieval and misuse of the admin account. ZDI/ZDI-adjacent disclosures describe a local privilege/escalation path leveragi...
The vulnerability of the Linter Bastion database management system allows a malicious individual to replace and execute the executable file.
In the database management system Linter Bastion, for encrypting BLOB data such as drawings, Word documents, PDF documents, etc., XOR encryption is used by default. As the gamma sequence the key for encryption is a static sequence of 255 bytes, this same gamma sequence is used for all databases. ...
IBM System Networking Switch Center DB Service Remote Elevation of Privilege Vulnerability
This vulnerability allows remote attackers to disclose information on vulnerable installations of IBM System Networking Switch Center. Authentication is not required to exploit this vulnerability. The specific flaw exists within the IBM SNSC DB Service, that listens by default on port 40999. This...
McAfee ePolicy Orchestrator Authenticated XXE Credential Exposure Exploit
This Metasploit module will exploit an authenticated XXE vulnerability to read the keystore.properties off of the filesystem. This properties file contains an encrypted password that is set during installation. What is interesting about this password is that it is set as the same password as the...
McAfee ePolicy Orchestrator Authenticated XXE Credentials Exposure
This module will exploit an authenticated XXE vulnerability to read the keystore.properties off of the filesystem. This properties file contains an encrypted password that is set during installation. What is interesting about this password is that it is set as the same password as the database 's...
SSH Static Key Accepted
The SSH server on the remote host accepts a publicly known static SSH private key for authentication. A remote attacker can log in to this host using this publicly known private key. TRUSTED...
Hewlett-Packard Intelligent Management Center CommonUtils Static DES/ECB Decryption Key Vulnerability
This vulnerability allows remote attackers to obtain sensitive information on vulnerable installations of Hewlett-Packard Intelligent Management Center. Authentication is not required to exploit this vulnerability. The specific flaw exists within the CommonUtil class. This application uses a stat...
