Backdoor.Win32.Cafeini.b Hardcoded Credential

Discovery / credits: Malvuln - malvuln.com c 2022 Original source: https://malvuln.com/advisory/851f8945d1b5923990f4722d627156a0.txt Contact: [email protected] Media: twitter.com/malvuln Threat: Backdoor.Win32.Cafeini.b Vulnerability: Weak Hardcoded Credentials Description: The malware listens ...

Verizon 4G LTE Network Extender - Weak Credentials Algorithm

Exploit Title: Verizon 4G LTE Network Extender - Weak Credentials Algorithm Exploit Author: LiquidWorm Vendor: Verizon Communications Inc. Product web page: https://www.verizon.com Affected version: GA4.38 - V0.4.038.2131 Summary: An LTE Network Extender enhances your indoor and 4G LTE data and...

Verizon 4G LTE Network Extender 0.4.038.2131 Weak Credential Algorithm

Verizon 4G LTE Network Extender Weak Credentials Algorithm Vendor: Verizon Communications Inc. Product web page: https://www.verizon.com Affected version: GA4.38 - V0.4.038.2131 Summary: An LTE Network Extender enhances your indoor and 4G LTE data and voice coverage to provide better service for...

Verizon 4G LTE Network Extender Weak Credentials Algorithm

Summary An LTE Network Extender enhances your indoor and 4G LTE data and voice coverage to provide better service for your 4G LTE mobile devices. It's an extension of our 4G LTE network that's placed directly in your home or office. The LTE Network Extender works with all Verizon-sold 4G LTE mobi...

Backdoor.Win32.FTP.Lana.01.d Hardcoded Credential

Discovery / credits: Malvuln - malvuln.com c 2022 Original source: https://malvuln.com/advisory/ea9ab5983a6fa71e31907e74d4ddbab6.txt Contact: [email protected] Media: twitter.com/malvuln Threat: Backdoor.Win32.FTP.Lana.01.d Vulnerability: Weak Hardcoded Credentials Family: Lana Type: PE32 MD5:...

Mitsubishi Electric Europe B.V. smartRTU and INEA ME-RTU Plaintext Storage of a Password (CVE-2019-14929)

An issue was discovered on Mitsubishi Electric ME-RTU devices through 2.02 and INEA ME-RTU devices through 3.0. Stored cleartext passwords could allow an unauthenticated attacker to obtain configured username and password combinations on the RTU due to the weak credentials management on the RTU. ...

Common Cloud Misconfigurations Exploited in Minutes, Report

Poorly configured cloud services can be exploit by threat actors in minutes and sometimes in under 30 seconds. Attacks include network intrusion, data theft and ransomware infections, researchers have found. Researchers at Palo Alto Networks’ Unit 42 used a honeypot infrastructure of 320 nodes...

CVE-2021-40520

Airangel HSMX Gateway devices through 5.2.04 have Weak SSH Credentials...

CVE-2021-37748

Multiple buffer overflows in the limited configuration shell /sbin/gsconfig on Grandstream HT801 devices before 1.0.29 allow remote authenticated users to execute arbitrary code as root via a crafted manageif setting, thus bypassing the intended restrictions of this shell and taking full control ...

Buffer overflow

Multiple buffer overflows in the limited configuration shell /sbin/gsconfig on Grandstream HT801 devices before 1.0.29 allow remote authenticated users to execute arbitrary code as root via a crafted manageif setting, thus bypassing the intended restrictions of this shell and taking full control ...

CVE-2021-37748

Multiple buffer overflows in the limited configuration shell /sbin/gsconfig on Grandstream HT801 devices before 1.0.29 allow remote authenticated users to execute arbitrary code as root via a crafted manageif setting, thus bypassing the intended restrictions of this shell and taking full control ...

CVE-2021-37748

CVE-2021-37748 affects Grandstream HT801 analog telephone adapters, with multiple buffer-overflow vulnerabilities in the limited configuration shell (/sbin/gs_config) that allow a remote, authenticated attacker to execute code as root via a crafted manage_if setting, bypassing shell restrictions ...

CVE-2021-41296

ECOA BAS controller uses weak set of default administrative credentials that can be easily guessed in remote password attacks and gain full control of the system...

CVE-2021-41296

CVE-2021-41296 affects ECOA BAS controller family (ECS Router Controller ECS (FLASH), RiskBuster Terminator E6L45, RiskBuster System RB 3.0.0/TRANE 1.0, Ecoa Graphic Control Software, Ecoa SmartHome II, etc.). Root cause: weak/default administrative credentials that can be guessed, allowing remot...

CVE-2021-41296

ECOA BAS controller uses weak set of default administrative credentials that can be easily guessed in remote password attacks and gain full control of the system...

New Capoae Malware Infiltrates WordPress Sites and Installs Backdoored Plugin

A recently discovered wave of malware attacks has been spotted using a variety of tactics to enslave susceptible machines with easy-to-guess administrative credentials to co-opt them into a network with the goal of illegally mining cryptocurrency. "The malware's primary tactic is to spread by...

COMMAX CVD-Axx DVR 5.1.4 Weak Default Credentials Stream Disclosure

COMMAX CVD-Axx DVR 5.1.4 Weak Default Credentials Stream Disclosure Vendor: COMMAX Co., Ltd. Prodcut web page: https://www.commax.com Affected version: CVD-AH04 DVR 4.4.1 CVD-AF04 DVR 4.4.1 CVD-AH16 DVR 5.1.4 CVD-AF16 DVR 4.4.1 CVD-AF08 DVR 5.1.2 CVD-AH08 DVR 5.1.2 Summary: COMMAX offers a wide...

COMMAX CVD-Axx DVR 5.1.4 - Weak Default Credentials Stream Disclosure

Exploit Title: COMMAX CVD-Axx DVR 5.1.4 - Weak Default Credentials Stream Disclosure Date: 02.08.2021 Exploit Author: LiquidWorm Vendor Homepage: https://www.commax.com COMMAX CVD-Axx DVR 5.1.4 Weak Default Credentials Stream Disclosure Vendor: COMMAX Co., Ltd. Prodcut web page:...

Schneider Electric EcoStruxure Control Expert 安全漏洞

Schneider Electric EcoStruxure Control Expert formerly Unity Pro is a suite of programming software for Schneider Electric logic controller products from Schneider Electric, France. A security vulnerability exists in various EcoStruxure products and stems from an under-protected credential...

Top 10 Cloud security tips

About half of the pen tests we’re asked to do involved cloud services at some point. We’ve even tested a cloud platform on an aeroplane – the irony was not lost on us! There is a multitude of ways to improve the security of your cloud platforms and often those ways are ever-changing or obscured...