D-Link DIR-815 Information Disclosure Vulnerability

D-Link DIR-815 is a wireless router product from AUO D-Link. An information disclosure vulnerability exists in the D-Link DIR-815 with firmware prior to version 2.07.B01, which originates from the program storing the administrative password in plaintext. A remote attacker could exploit this...

CVE-2018-11527

An issue was discovered in CScms v4.1. A Cross-site request forgery CSRF vulnerability in plugins/sys/admin/Sys.php allows remote attackers to change the administrator's username and password via /admin.php/sys/editpasssave...

Huawei 1288H V5 and 2288H V5 JSON Injection Vulnerability (CNVD-2018-10504)

The Huawei 1288H V5 and 2288H V5 are both rackmount server units from Huawei, a Chinese company. A security vulnerability exists in Huawei 1288H V5 and 2288H V5 version V100R005C00, which originates from the program failing to adequately validate input. A remote attacker can exploit the...

Huawei 1288H and 2288H Rack Server JSON Injection Vulnerability

Huawei 1288H V5 and 2288H V5 are both rack routers that can be widely used for cloud virtualization, database, big data and other loads. A JSON injection vulnerability exists in the V100R005C00 software of the Huawei 1288H V5 and 2288H V5. The vulnerability stems from the program failing to...

CVE-2018-7902

Affected products: Huawei 1288H V5 and 288H V5 with software V100R005C00. Vulnerability: JSON injection in iBMC/server component due to insufficient input validation, allowing an authenticated, remote attacker to inject JSON and modify the administrator password, potentially gaining the system ma...

CVE-2013-3018

The AXIS webapp in deploy-tomcat/axis in IBM Tivoli Application Dependency Discovery Manager TADDM 7.1.2 and 7.2.0 through 7.2.1.4 allows remote attackers to obtain sensitive configuration information via a direct request, as demonstrated by happyaxis.jsp. IBM X-Force ID: 84354. Recent assessment...

Design/Logic Flaw

An exploitable clear text transmission of password vulnerability exists in the web server and telnet functionality of Moxa EDR-810 V4.1 build 17030317. An attacker can look at network traffic to get the admin password for the device. The attacker can then use the credentials to login as admin...

CVE-2018-10989

Arris Touchstone Telephony Gateway TG1682G 9.1.103J6 devices are distributed by some ISPs with a default password of "password" for the admin account that is used over an unencrypted http://192.168.0.1 connection, which might allow remote attackers to bypass intended access restrictions by...

D-Link DIR-868L Cross-Site Request Forgery Vulnerability

D-Link DIR-868L is a wireless router product from AUO D-Link. A cross-site request forgery vulnerability exists in the hedwig.cgi and pigwidgeon.cgi files in the D-Link DIR-868L. A remote attacker can exploit this vulnerability to change the Admin password...

CVE-2018-10957

CSRF exists on D-Link DIR-868L devices, leading to for example a change to the Admin password. hedwig.cgi and pigwidgeon.cgi are two of the affected components...

CVE-2018-10957

CVE-2018-10957 affects the D-Link DIR-868L router. The vulnerability is a CSRF in the affected components hedwig.cgi and pigwidgeon.cgi that can allow a remote attacker to perform actions such as changing the Admin password. Impact is described across multiple sources; no official patch/version i...

PT-2018-3909 · D Link · D-Link Dir-868L

Name of the Vulnerable Software and Affected Versions: D-Link DIR-868L affected versions not specified Description: The issue is related to a CSRF Cross-Site Request Forgery attack, which can be exploited by a remote attacker. This could allow the attacker to perform actions such as changing the...

CVE-2018-10723

Directus 6.4.9 has a hardcoded admin password for the Admin account because of an INSERT statement in api/schema.sql...

Hardcoded credentials

Directus 6.4.9 has a hardcoded admin password for the Admin account because of an INSERT statement in api/schema.sql...

CVE-2018-10723

Directus 6.4.9 has a hardcoded admin password for the Admin account because of an INSERT statement in api/schema.sql...

Contec Smart Home Unauthorized Password Reset Vulnerability

Contec Smart Home is a smart home management system for managing connected smart home devices. A security vulnerability exists in Contec Smart Home version 4.15, which stems from the program failing to require authentication for the newuser.php, edituser.php, deleteuser.php, and user.php files. A...

CVE-2018-1000158

cmsmadesimple version 2.2.7 contains a Incorrect Access Control vulnerability in the function of sendrecoveryemail in the line "$url = $config'adminurl' . '/login.php?recoverme=' . $code;" that can result in Administrator Password Reset Poisoning, specifically a reset URL pointing at an attacker...

CVE-2018-10081

CMS Made Simple CMSMS through 2.2.6 contains an admin password reset vulnerability because data values are improperly compared, as demonstrated by a hash beginning with the "0e" substring...

CVE-2018-10081

CMS Made Simple (CMSMS) up to version 2.2.6 contains an admin password reset vulnerability caused by improper comparison of data values, illustrated by a hash starting with the "0e" substring. The vulnerability enables unauthorized password resets. Affected product/version: CMSMS ≤ 2.2.6. Root ca...

Moxa EDR-810 Cleartext Transmission of Password Vulnerability

Summary An exploitable clear text transmission of password vulnerability exists in the web server and telnet functionality of Moxa EDR-810 V4.1 build 17030317. An attacker can look at network traffic to get the admin password for the device. The attacker can then use the credentials to login as...