335 matches found
CVE-2015-6472
WAGO IO 750-849 01.01.27 and 01.02.05, WAGO IO 750-881, and WAGO IO 758-870 have weak credential management...
CVE-2015-6472
CVE-2015-6472 affects WAGO IO PLCs: specifically WAGO IO 750-849 (firmware 01.01.27 and 01.02.05) and 750-881, and WAGO IO 758-870, with weak credential management in their web-based management interfaces. This is the underlying root cause described in the public records, leading to potential imp...
LinEnum v0.6 - Scripted Local Linux Enumeration and Privilege Escalation Checks
LinEnum will automate many of the checks that I’ve documented in the Local Linux Enumeration & Privilege Escalation Cheatsheet. It’s a very basic shell script that performs over 65 checks, getting anything from kernel information to locating possible escalation points such as potentially useful...
Arbitrary File Upload Vulnerability in eWebEditor Editor of Fuzhou Extreme Software Development Co.
Fuzhou Extreme Software Development Co. eWebEditor editor is a browser-based online HTML editor. An arbitrary file upload vulnerability exists in the eWebEditor editor of Fuzhou Extreme Software Development Co. Due to logging into the backend via anonymous access or weak account/password...
Ubiquiti Inc.: Weak credentials for nutty.ubnt.com
nutty.ubnt.com has a login link, when clicking on it the user is presented with a login form. using 'admin' for both username and password results in valid session. this account allow for the upload of arbitrary files. I am checking to see if this will allow for further functionality like a websh...
BINOM3 Electric Power Quality Meter (Update A)
CVSS v3 10 ATTENTION: Remotely exploitable/low skill level to exploit Vendor: BINOM3 Equipment: Electric Power Quality Meter Vulnerabilities: Cross-site scripting, access control issues, cross-site request forgery CSRF, sensitive information stored in clear-text, and weak credentials management...
BINOM3 Electric Power Quality Meter
CVSS v3 10 ATTENTION: Remotely exploitable/low skill level to exploit Vendor: BINOM3 Equipment: Electric Power Quality Meter Vulnerabilities: Cross-site scripting, access control issues, cross-site request forgery CSRF, sensitive information stored in clear-text, and weak credentials management...
BINOM3 Power Meter CSRF / XSS / Credential Management
Universal multifunctional Electric Power Quality Meter BINOM3 - Multiple Vulnerabilities About The meters are designed for autonomous operation in automated systems: aC/ SCADA systems aC/ Data aquisition and transmission systems aC/ Automated data and measurement systems for revenue and technical...
ELNet Power Meter Unauthenticated Access / Weak Credential Management
ELNet Energy & Electrical Power Meter - Mulitple Vulnerabilities http://elnet.feniks-pro.com/Elnet-LT.php http://www.elnet.cc/product/elnet-lt/ Powermeter with color graphic display for all electrical measurements and harmonics, with TCP/IP and RS485 communication ModBus and Bacnet, panel mounted...
Number of Devices Sharing Private Crypto Keys Up Sharply
Researchers at SEC Consult say the number of internet gateways, routers, modems and other embedded devices sharing cryptographic keys and certificates is up 40 percent since the Austrian consulting firm first looked at the problem in November. The report, posted Tuesday called “House of Keys,”...
Bellini/Supercook Wi-Fi Yumi SC200 - Multiple Vulnerabilities
''' Bellini/Supercook Wi-Fi Yumi SC200 - Multiple vulnerabilities Reported By: ================================== James McLean - Primary: james dot mclean at gmail dot com Secondary: labs at juicedigital dot net Device Overview: ================================== From...
RS232-NET Converter (JTC-200) CSRF / Weak Credentials / Unauthenticated Access
RS232-NET Converter JTC-200 - Multiple vulnerabilities About RS232-NET Converter model JTC-200 http://www.jantek.com.tw/en/product/73 Seen deployed in: CHTD, Chunghwa Telecom Co., Ltd. Taiwan HiNet Taiwan & China PT Comunicacoes Portugal Sony Network Taiwan Limited Taiwan Vodafone Portugal Portug...
EdgeCore ES3526XA Manager CSRF / Access Bypass / Weak Credentials
EdgeCore - Layer2+ Fast Ethernet Standalone Switch ES3526XA Manager - Multiple Vulnerabilities Also rebranded as: SMC TigerSwitch 10/100 SMC6128L2 Manager Object ID: 1.3.6.1.4.1.259.8.1.5 Switch Information Main Board: Number of Ports 26 Hardware Version R01 Management Software: Loader Version...
Sierra Wireless AirLink Raven XE Industrial 3G Gateway CSRF / File Upload
Sierra Wireless AirLink Raven XE Industrial 3G Gateway - Multiple Vulnerabilities About http://www.sierrawireless.com/products-and-solutions/gateway-solutions/raven-series/ Rugged Design and Advanced Security for Fixed and Portable Wireless Communication Raven XE/XT Compact design for industrial...
Papouch Backdoor Account / CSRF / Missing Authentication
+++++ Vulnerable Products 1. Papouch TME Ethernet thermometer 2. Papouch TME multi: Temperature and humidity via Ethernet All versions affected TME - Ethernet Thermometer http://www.papouch.com/en/shop/product/tme-ip-ethernet-thermometer/ TME multi: Temperature and humidity via Ethernet...
HP StoreEver MSL6480 Tape Library 4.10 Weak Credentials / CSRF / Access Control
HP StoreEver MSL6480 Tape Library v4.10 - Multiple Vulnerabilities Confirmed on firmware version 4.10 HPE PSRT response: Upgrade to MSL6480 is 4.90 current version Weak Credentials Management The device comes with weak, default login credentials - security/security - and the application does not...
Pornhub: (Pornhub & Youporn & Brazzers ANDROID APP) : Upload Malicious APK / Overrite Existing APK / Android BackOffice Access
The researcher discovered weak credentials protecting an Android APK admin page...
JVC XSS / CSRF / Header Injection / Weak Credentials
| | | | \ |\ \ \ / - | | | | - /| //||||,|.// www.orwelllabs.com security advisory olsa-2016-04-01 Adivisory Information +++++++++++++++++++++++ + Title: JVC Multiple Products Multiple Vulnerabilities + Vendor: JVC Professional Video + Research and Advisory: Orwelllabs + Adivisory URL:...
Wendy's Comes Clean On Data Breach
Fast-food chain Wendy’s disclosed it was a victim of a point-of-sale system attack that installed malware on PoS computers affecting 300 franchise restaurants. The disclosure was part the company’s first quarter 2016 SEC filings on Wednesday and is the most complete account to date of a 2015 data...
