WAVLINK WL-WN579G3 and WL-WN575A3 Information Disclosure Vulnerability

WAVLINK WL-WN579G3 and WL-WN575A3 are both wireless network signal extenders from China-based RuiYin Technology WAVLINK. A security vulnerability exists in the backup function in WAVLINK WL-WN579G3 - M79X3.V5030.180719 version and WL-WN575A3 - RPT75A3.V4300.180801 version. An attacker can exploit...

CVE-2020-10916

This vulnerability allows network-adjacent attackers to escalate privileges on affected installations of TP-Link TL-WA855RE Firmware Ver: 855rev4-up-ver1-0-1-P120191213-rel60361 Wi-Fi extenders. Although authentication is required to exploit this vulnerability, the existing authentication mechani...

CVE-2020-10973

An issue was discovered in Wavlink WN530HG4, Wavlink WN531G3, Wavlink WN533A8, and Wavlink WN551K1 affecting /cgi-bin/ExportAllSettings.sh where a crafted POST request returns the current configuration of the device, including the administrator password. No authentication is required. The attacke...

CVE-2020-10972

An issue was discovered where a page is exposed that has the current administrator password in cleartext in the source code of the page. No authentication is required in order to reach the page a certain live?.shtml page with the variable syspasswd. Affected Devices: Wavlink WN530HG4, Wavlink...

IBM Data Risk Manager Code Execution Vulnerability

IBM Data Risk Manager is a data risk manager from IBM USA. The product supports discovery, analysis and visualization of business risk data, among other things. A code execution vulnerability exists in IBM Data Risk Manager, which stems from the use of a default password for the IDRM administrati...

TP-Link TL-WA855RE login.json Authentication Privilege Elevation Improper Vulnerability

The TP-Link TL-WA855RE is a wireless network signal extender from China P&L TP-Link. A security vulnerability exists in the initial setup process in the TP-Link TL-WA855RE, which stems from the program failing to properly validate the initial setup request. The vulnerability can be exploited by a...

CVE-2017-18777

Certain NETGEAR devices are affected by administrative password disclosure. This affects D6220 before V1.0.0.28, D6400 before V1.0.0.60, D8500 before V1.0.3.29, DGN2200v4 before 1.0.0.82, DGN2200Bv4 before 1.0.0.82, R6300v2 before 1.0.4.8, R6400 before 1.0.1.20, R6700 before 1.0.1.20, R6900 befor...

P5 FNIP-8x16A/FNIP-4xSH CSRF / Cross Site Scripting

!-- C...

D-Link DSL-2640B B2 Authorization Issue Missing

The D-Link DSL-2640B B2 is a wireless router from AUO D-Link of Taiwan, China. A security vulnerability exists in the D-Link DSL-2640B B2 EU4.01B version. An attacker can exploit this vulnerability by accessing the cgi module to bypass authentication and perform administrative operations e.g.,...

Authentication flaw

An issue was discovered on D-Link DSL-2640B B2 EU4.01B devices. Authentication can be bypassed when accessing cgi modules. This allows one to perform administrative tasks e.g., modify the admin password with no authentication...

CVE-2020-11818

In Rukovoditel 2.5.2 has a formsessiontoken value to prevent CSRF attacks. This protection mechanism can be bypassed with another user's valid token. Thus, an attacker can change the Admin password by using a CSRF attack and escalate his/her privileges...

CVE-2020-11818

In Rukovoditel 2.5.2 has a formsessiontoken value to prevent CSRF attacks. This protection mechanism can be bypassed with another user's valid token. Thus, an attacker can change the Admin password by using a CSRF attack and escalate his/her privileges...

Cross site request forgery (csrf)

In Rukovoditel 2.5.2 has a formsessiontoken value to prevent CSRF attacks. This protection mechanism can be bypassed with another user's valid token. Thus, an attacker can change the Admin password by using a CSRF attack and escalate his/her privileges...

CVE-2020-11818

In Rukovoditel 2.5.2 has a formsessiontoken value to prevent CSRF attacks. This protection mechanism can be bypassed with another user's valid token. Thus, an attacker can change the Admin password by using a CSRF attack and escalate his/her privileges...

GHSA-6PMV-7PR9-CGRJ Predictable password in Keycloak

A flaw was found in all versions of the Keycloak operator, before version 8.0.2,community only where the operator generates a random admin password when installing Keycloak, however the password remains the same when deployed to the same OpenShift namespace...

Argo Authorization Issues Vulnerability

Argo is an open source container native workflow engine. Argo suffers from an authorization issue vulnerability that stems from the program setting the default administrator password to the argocd-server container group name. An attacker can exploit this vulnerability to gain administrator...

Unauthorized Access Vulnerability in Website Building System of Hebei Tangshan Great Wall Network Co.

Tangshan Great Wall Network Co., Ltd. case more than 200, standardized station building process, from the signing to the delivery of the site by the project director is responsible for the overall progress, to ensure the progress of website construction and quality. Hebei Tangshan Great Wall...

CVE-2020-8828

As of v1.5.0, the default admin password is set to the argocd-server pod name. For insiders with access to the cluster or logs, this issue could be abused for privilege escalation, as Argo has privileged roles. A malicious insider is the most realistic threat, but pod names are not meant to be ke...

Default credentials

As of v1.5.0, the default admin password is set to the argocd-server pod name. For insiders with access to the cluster or logs, this issue could be abused for privilege escalation, as Argo has privileged roles. A malicious insider is the most realistic threat, but pod names are not meant to be ke...

CVE-2020-8828

As of v1.5.0, the default admin password is set to the argocd-server pod name. For insiders with access to the cluster or logs, this issue could be abused for privilege escalation, as Argo has privileged roles. A malicious insider is the most realistic threat, but pod names are not meant to be ke...