CVE-2017-16744

A path traversal vulnerability in Tridium Niagara AX Versions 3.8 and prior and Niagara 4 systems Versions 4.4 and prior installed on Microsoft Windows Systems can be exploited by leveraging valid platform administrator credentials...

Zoho ManageEngine Applications Manager SQL Injection Vulnerability (CNVD-2018-15179)

ZOHO ManageEngine Applications Manager is a set of IT operation and maintenance management solutions of the United States ZhuoHao ZOHO company. The product has application performance management, fault management, report generation and SLA management and other functions. A SQL injection...

Dicoogle PACS 2.5.0 Directory Traversal

Exploit Title: Dicoogle PACS 2.5.0 - Directory Traversal Date: 2018-05-25 Software Link: http://www.dicoogle.com/home Version: Dicoogle PACS 2.5.0-201712291522 Category: webapps Tested on: Windows 2012 R2 Exploit Author: Carlos Avila Contact: http://twitter.com/badboynt 1. Description Dicoogle is...

Timehop Breach Impacts Personal Data of 21 Million Users

The personal data of millions of Timehop customers has been compromised after a hacker gained access to its cloud-based backend computing environment. Timehop, a service that plugs into users’ social media platforms and shows them memories from the past, disclosed the data breach on Sunday. The...

Foscam Foscam Camera Command Injection Vulnerability

FOSCAM, the safe life brand of Shenzhen FOSCAM Intelligent Technology Co., Ltd, covers network video surveillance products network cameras, hard disk recorders, surveillance kits, video cloud storage services and so on. Foscam Foscam Camera suffers from a command injection vulnerability, which...

CVE-2018-11527

CVE-2018-11527 affects CScms v4.1, where a Cross-site request forgery (CSRF) in plugins/sys/admin/Sys.php allows remote attackers to change the administrator’s username and password via /admin.php/sys/editpass_save. Exploitation details are not provided beyond the path, but the vulnerability enab...

CVE-2018-0222

A vulnerability in Cisco Digital Network Architecture DNA Center could allow an unauthenticated, remote attacker to log in to an affected system by using an administrative account that has default, static user credentials. The vulnerability is due to the presence of undocumented, static user...

CVE-2018-0277

A vulnerability in the Extensible Authentication Protocol-Transport Layer Security EAP-TLS certificate validation during EAP authentication for the Cisco Identity Services Engine ISE could allow an unauthenticated, remote attacker to cause the ISE application server to restart unexpectedly, causi...

Foxconn FEMTO AP-FC4064-T Weak Password Vulnerability

The Foxconn FEMTO AP-FC4064-T is a home base station device from Foxconn. A security vulnerability exists in the web administration page of the Foxconn FEMTO AP-FC4064-T APGTB385.8.3lb15-W47 LTE Build 15 version, which stems from the admin account using a weak default password: admin, and the...

Moxa EDR-810 Password Plaintext Transfer Vulnerability

The EDR-810 is a highly integrated industrial multi-port security router with firewall/NAT/VPN and two-layer manageable switch functionality. A password cleartext transfer vulnerability exists in the Web server and Telnet functionality of the Moxa EDR-810 V4.1 build 17030317. An attacker can...

CVE-2017-12123

An exploitable clear text transmission of password vulnerability exists in the web server and telnet functionality of Moxa EDR-810 V4.1 build 17030317. An attacker can look at network traffic to get the admin password for the device. The attacker can then use the credentials to login as admin...

CVE-2017-12123

An exploitable clear text transmission of password vulnerability exists in the web server and telnet functionality of Moxa EDR-810 V4.1 build 17030317. An attacker can look at network traffic to get the admin password for the device. The attacker can then use the credentials to login as admin...

PT-2018-5364 · Moxa · Moxa Edr-810

Name of the Vulnerable Software and Affected Versions: Moxa EDR-810 version 4.1 build 17030317 Description: A clear text transmission of password issue exists in the web server and telnet functionality. An attacker can intercept network traffic to obtain the admin password for the device, and the...

Hacking train passenger Wi-Fi

After speaking about Wi-Fi security at a rail industry conference last week, it struck me that very insecure passenger networks are making their way on to trains. So, here’s a quick check list for making sure your pax Wi-Fi network is secure. Similar checks could be applied to your guest network ...

Ericson-LG iPECS NMS Information Disclosure Vulnerability

The Ericsson-LG iPECS NMS is a network management solution from Ericson-LG in Korea. A security vulnerability exists in the web application in Ericsson-LG iPECS NMS version A.1Ac. The vulnerability can be exploited by an attacker to obtain sensitive information e.g., NMS admin credentials and...

CVE-2018-10286

The Ericsson-LG iPECS NMS A.1Ac web application discloses sensitive information such as the NMS admin credentials and the PostgreSQL database credentials to logged-in users via the responses to certain HTTP POST requests. In order to be able to see the credentials in cleartext, an attacker needs ...

CVE-2018-10286

The CVE-2018-10286 case involves Ericsson-LG iPECS NMS A.1Ac Web App. It discloses sensitive data (NMS admin credentials and PostgreSQL credentials) to logged-in users via HTTP POST responses. Affected component: web application; root cause: credentials exposed in responses to authenticated reque...

Code execution vulnerability in TP-Link enterprise routers (CNVD-2018-08408)

Tplink ER5110G, Tplink ER5120G and Tplink WAR1300L are enterprise VPN routers and enterprise wireless VPN routers. A code execution vulnerability exists in TP-Link Enterprise Routers. An attacker can exploit the vulnerability to obtain the router's administrator username and password, or hijack a...

D-Link DIR-601 Information Disclosure Vulnerability

D-Link DIR-601 is a wireless router product from AUO. The D-Link DIR-601 information disclosure vulnerability can be exploited by an attacker to obtain the administrator username/password to access the administrator panel...

Wanscam HW0021 Administrator Credentials Disclosure

Wanscam HW0021 discloses admin credentials to unauthenticated users. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...