CVE-2021-27782

HCL BigFix Mobile / Modern Client Management Admin and Config UI passwords can be brute-forced. User should be locked out for multiple invalid attempts...

Code injection

HCL BigFix Mobile / Modern Client Management Admin and Config UI passwords can be brute-forced. User should be locked out for multiple invalid attempts...

PT-2023-15469 · Yeastar · Yeastar N412 +3

Name of the Vulnerable Software and Affected Versions: Yeastar N412 and N824 Configuration Panel versions 42.x through 45.x Description: An unauthenticated attacker can create a backup file and download it, revealing the admin hash. If the hash is cracked, it allows the attacker to log in to the...

CVE-2022-47732

In Yeastar N412 and N824 Configuration Panel 42.x and 45.x, an unauthenticated attacker can create backup file and download it, revealing admin hash, allowing, once cracked, to login inside the Configuration Panel, otherwise, replacing the hash in the archive and restoring it on the device which...

PT-2023-12120 · Hcl · Hcl Bigfix Mobile / Modern Client Management

Name of the Vulnerable Software and Affected Versions: HCL BigFix Mobile / Modern Client Management affected versions not specified Description: The issue allows passwords for the Admin and Config UI to be brute-forced. It is recommended that users should be locked out after multiple invalid...

CVE-2022-45922

An issue was discovered in OpenText Content Suite Platform 22.1 16.2.19.1803. The request handler for ll.KeepAliveSession sets a valid AdminPwd cookie even when the Web Admin password was not entered. This allows access to endpoints, which require a valid AdminPwd cookie, without knowing the...

CVE-2022-45922

An issue was discovered in OpenText Content Suite Platform 22.1 16.2.19.1803. The request handler for ll.KeepAliveSession sets a valid AdminPwd cookie even when the Web Admin password was not entered. This allows access to endpoints, which require a valid AdminPwd cookie, without knowing the...

OpenText Content Suite Platform 安全漏洞

OpenText Content Suite Platform is a top-of-the-line enterprise content management ECM system from OpenText. can manage the entire enterprise information lifecycle, from capture to archiving and disposal. A security vulnerability exists in OpenText Content Suite Platform version 22.1, which stems...

CVE-2022-36222

Nokia Fastmile 3tg00118abad52 devices shipped by Optus are shipped with a default hardcoded admin account of admin:Nq+L5st7o This account can be used locally to access the web admin interface...

CVE-2022-3485

In IFM Moneo Appliance with version up to 1.9.3 an unauthenticated remote attacker can reset the administrator password by only supplying the serial number and thus gain full control of the device...

IFM Moneo Appliance 授权问题漏洞

The IFM Moneo Appliance QHA200 and the IFM Moneo Appliance QHA210 are both pieces of hardware from IFM Germany that are used to operate Moneo in the production process. An authorization issue vulnerability exists in IFM Moneo Appliance versions prior to 1.9.3. An attacker could exploit this...

PT-2022-22393 · Ifm · Ifm Moneo Appliance

Name of the Vulnerable Software and Affected Versions: IFM Moneo Appliance versions up to 1.9.3 Description: An unauthenticated remote attacker can reset the administrator password by only supplying the serial number, thus gaining full control of the device. Recommendations: For versions up to...

DEBIAN-CVE-2022-45868

The web-based admin console in H2 Database Engine before 2.2.220 can be started via the CLI with the argument -webAdminPassword, which allows the user to specify the password in cleartext for the web admin console. Consequently, a local user or an attacker that has obtained local access through...

CVE-2022-45276

An issue in the /index/user/useredit.html component of YJCMS v1.0.9 allows unauthenticated attackers to obtain the Administrator account password...

ovirt-engine: RHVM admin password is logged unfiltered when using otopi-style

A flaw was found in ovirt-engine, which leads to the logging of plaintext passwords in the log file when using otapi-style. This flaw allows an attacker with sufficient privileges to read the log file, leading to confidentiality loss...

Directorist < 7.4.2.2 - Subscriber+ Arbitrary User Password Update via IDOR

The plugin suffers from an IDOR vulnerability which an attacker can exploit to change the password of arbitrary users instead of his own. PoC The following Python script automates the exploitation of this vulnerability. The script was tested on an installation of WordPress 6.1 with the vulnerable...

RHEL 8 : RHV Manager (ovirt-engine) [ovirt-4.5.3] (RHSA-2022:8502)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:8502 advisory. The ovirt-engine package provides the Red Hat Virtualization Manager, a centralized management platform that allows system administrators to...

CVE-2022-40843

The Tenda AC1200 V-W15Ev2 V15.11.0.101576 router is vulnerable to improper authorization / improper session management that allows the router login page to be bypassed. This leads to authenticated attackers having the ability to read the routers syslog.log file which contains the MD5 password of...

PT-2022-25574 · Tenda · Tenda Ac1200

Name of the Vulnerable Software and Affected Versions: Tenda AC1200 V-W15Ev2 version V15.11.0.101576 Description: The issue concerns improper authorization and improper session management, allowing the router login page to be bypassed. This enables authenticated attackers to read the router's...

CVE-2022-45130

Plesk Obsidian allows a CSRF attack, e.g., via the /api/v2/cli/commands REST API to change an Admin password. NOTE: Obsidian is a specific version of the Plesk product: version numbers were used through version 12, and then the convention was changed so that versions are identified by names...