CVE-2013-3615

Dahua DVR appliances use a password-hash algorithm with a short hash length, which makes it easier for context-dependent attackers to discover cleartext passwords via a brute-force attack...

IBM Security AppScan Enterprise 弱密码安全绕过漏洞(CVE-2013-0531)

BUGTRAQ ID: 62179 CVECAN ID: CVE-2013-0531 IBM Securityl AppScan Enterprise 是一个基于Web 的多用户Web 应用程序安全解决方案，提供集中的安全性扫描、数据合并和报告、补救功能、执行仪表板等功能 IBM Security AppScan Enterprise 即之前的IBM Rational AppScan Enterprise 支持使用弱加密算法的SSL套件，攻击者无需本地网络访问及身份验证，即可利用此漏洞解密客户端和服务器之间的通讯，或在客户端上执行中间人攻击，从而获取敏感信息，执行未授权操作 0 IBM...

V5shop数据库弱口令导致内部更多敏感数据可被社工（已证明）

简要描述： http://www.wooyun.org/bugs/wooyun-2013-027611 大家看我发的上一个漏洞！ 我社工了一下下..... 详细说明： 不打码了，白帽子也要被尊重！ wooyun-2013-027611这个漏洞引发的... 你们从图片看到什么了吗？ lvw马赛克08.net 对了，这就是亮点，目测QQ企业邮箱的 解密了！刚刚充了1000条，呵呵 lvw马赛克08.net Lvw马赛克996 看看企业邮箱！ 好吧！成功了................. 漏洞证明： 好多信息泄漏！...

Russian Cyber Criminals selling hacked websites access in Underground stores

Underground sites more commonly offer access to networks of compromised machines or stolen credit card information. Webroot has uncovered a criminal underground store dedicated to selling access to more than tens of thousands of hacked legitimate websites. Their customers can buy an administrator...

用友内部管理系统后台未授权访问（弱口令）

简要描述： 见说明 详细说明： 网址 http://125.35.5.195:808/login.jsp 在java环境下，当然，如果提示安装插件就安装吧，因为是用友登陆的一个java插件，安装后 套帐:选择用友软件测试 公司:随便选吧，里面那么多，我选的是集团0001 当然也可以用其他的去尝试--! 用户：test 密码：123456 然后就一咕噜进去了 --! 漏洞证明： img src="https://images.seebug.org/upload/201307/13...

53KF-MongoDB数据库弱口令可远程直接查询库内数据

简要描述： 不需要认证，可以直接连接，操作MongoDB 详细说明： 没有做认证，导致可以直接操纵库 漏洞证明： 未做验证的ip: 60.12.147.151 221.12.88.75 122.227.58.188...

用友iTrusCA控制台弱口令可控制服务器端口

简要描述： 见说明 详细说明： 地址 http://ca.ufida.com.cn:8080/admin-enroll/console/ http://ca.ufida.com.cn:8080/admin-enroll/console/console.do 账号密码 admin 可改端口，改完保存下就可以了，应该可以影响到内网 挖洞辛苦，凑合着过吧！ --！ 漏洞证明：...

1 3 9 mailbox of the user experience center of the back of the weak password vulnerability warning-the black bar safety net

Brief description: Administrator password security awareness is weak, password is too simple. Detailed description: The background of the page easily obtained. http://uec.mail.10086.cn/admin/login.jsp User password: admin directly to the background, Vulnerability proof: ! !...

New network vulnerabilities of the VPS automated production systems many VPS password leak-vulnerability warning-the black bar safety net

The new network of the VPS automated production system column of the directory can view the system log file From the log file to find the background of the account after the burp blasting is actually a weak password The background relates to the user of the vps password log leaked url:...

KDE Paste applet weak password generation

Weak PRNG...

WebSphere 弱密码漏洞

websphere只测6.0.2.25版本默认情况下， 可用弱口令登录，从而导致攻击者可据此信息进行后续攻击。...

eWebEditor 弱密码漏洞

eWebEditor是一个基于浏览器的在线HTML编辑器，其存在弱密码漏洞，攻击者可以利用该漏洞进行恶意登录。 eWebEditor !/usr/bin/env python coding: utf-8 from pocsuite.net import req from pocsuite.poc import POCBase, Output from pocsuite.utils import register class TestPOCPOCBase: vulID = '62352' ssvid version = '1.0' author = '' vulDate =...

Customer King E4 case of landing improperly configured+weak password, the company's internal sensitive information disclosure-vulnerability warning-the black bar safety net

Brief description: The company login screen is really distinctive...actually put a user name to everyone, but also be able to view the online status of.. The user is not much, weak passwordsdown quite a bit. Detailed description: Didn't get to the administrator account,but user permissions enough...

D-Link DIR-300B / DIR-600B / DIR-815 / DIR-645 HTTP Login Utility

This module attempts to authenticate to different D-Link HTTP management services. It has been tested successfully on D-Link DIR-300 Hardware revision B, D-Link DIR-600 Hardware revision B, D-Link DIR-815 Hardware revision A and DIR-645 Hardware revision A devices. It is possible that this module...

D-Link DIR-615H HTTP Login Utility

This module attempts to authenticate to different D-Link HTTP management services. It has been tested successfully on D-Link DIR-615 Hardware revision H devices. It is possible that this module also works with other models. This module requires Metasploit: https://metasploit.com/download Current...

ShopEx 同IP下站点 PHPMYADMIN 弱口令

简要描述： ShopEx 同站点IP的站phpmyadmin弱口令 如果被长期蹲点可能会导致ShopEx 被撸！ 详细说明： 今天无聊扫了下ShopEx 看看有没什么洞 然后发现 存在DEDE的后台 用尽各种网上的EXP无果 直接打 phpmyadmin撸进 各种密码组合弱口令尝试无果 灵光一闪 用该站的域名进去了去掉www..com 漏洞证明： phpmyadmin后台 dede后台 一句话...

Huawei (Multiple Products) - Password Encryption

source: https://www.securityfocus.com/bid/56510/info Multiple Huawei products are prone to a weak password encryption weakness. Successful exploits may allow an attacker to decrypt stored passwords; this may aid in further attacks. The following are vulnerable: Huawei Quidway series Huawei CX600...

Authentec UPEK Protector Suite Weak Password Storage

The remote host has, or has had Authentec UPEK Protector Suite installed. Nessus was able to decrypt user credentials stored in an insecure manner in the Windows registry by UPEK Protector Suite. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid62627; scriptversion"1.7...

CVE-2012-4899

WellinTech KingView 6.5.3 and earlier uses a weak password-hashing algorithm, which makes it easier for local users to discover credentials by reading an unspecified file...

Default credentials

WellinTech KingView 6.5.3 and earlier uses a weak password-hashing algorithm, which makes it easier for local users to discover credentials by reading an unspecified file...