Backdoor.Win32.HoneyPot.a MVID-2022-0622 Weak Hardcoded Password

Discovery / credits: Malvuln John Page aka hyp3rlinx c 2022 Original source: https://malvuln.com/advisory/e3bb503f9b02cf57341695f30e31128f.txt Contact: [email protected] Media: twitter.com/malvuln Threat: Backdoor.Win32.HoneyPot.a Vulnerability: Weak Hardcoded Password Description: The malware...

CVE-2022-32985

libnxapl.so on Nexans FTTO GigaSwitch before 6.02N and 7.x before 7.02 implements a Backdoor Account for SSH logins on port 50200 or 50201...

CVE-2022-32985

libnxapl.so on Nexans FTTO GigaSwitch before 6.02N and 7.x before 7.02 implements a Backdoor Account for SSH logins on port 50200 or 50201...

CVE-2022-32985

libnxapl.so on Nexans FTTO GigaSwitch before 6.02N and 7.x before 7.02 implements a Backdoor Account for SSH logins on port 50200 or 50201...

CVE-2022-26479

An issue was discovered in Poly EagleEye Director II before 2.2.2.1. Existence of a certain file which can be created via an rsync backdoor causes all API calls to execute as admin without authentication...

CVE-2022-31210

An issue was discovered in Infiray IRAY-A8Z3 1.0.957. The binary file /usr/local/sbin/webproject/setparam.cgi contains hardcoded credentials to the web application. Because these accounts cannot be deactivated or have their passwords changed, they are considered to be backdoor accounts...

CVE-2022-31210

An issue was discovered in Infiray IRAY-A8Z3 1.0.957. The binary file /usr/local/sbin/webproject/setparam.cgi contains hardcoded credentials to the web application. Because these accounts cannot be deactivated or have their passwords changed, they are considered to be backdoor accounts...

CVE-2022-31210

An issue was discovered in Infiray IRAY-A8Z3 1.0.957. The binary file /usr/local/sbin/webproject/setparam.cgi contains hardcoded credentials to the web application. Because these accounts cannot be deactivated or have their passwords changed, they are considered to be backdoor accounts...

CVE-2022-26479

An issue was discovered in Poly EagleEye Director II before 2.2.2.1. Existence of a certain file which can be created via an rsync backdoor causes all API calls to execute as admin without authentication...

Authentication flaw

An issue was discovered in Poly EagleEye Director II before 2.2.2.1. Existence of a certain file which can be created via an rsync backdoor causes all API calls to execute as admin without authentication...

Code injection

libnxapl.so on Nexans FTTO GigaSwitch before 6.02N and 7.x before 7.02 implements a Backdoor Account for SSH logins on port 50200 or 50201...

Hardcoded credentials

An issue was discovered in Infiray IRAY-A8Z3 1.0.957. The binary file /usr/local/sbin/webproject/setparam.cgi contains hardcoded credentials to the web application. Because these accounts cannot be deactivated or have their passwords changed, they are considered to be backdoor accounts...

CVE-2022-32985

libnxapl.so on Nexans FTTO GigaSwitch before 6.02N and 7.x before 7.02 implements a Backdoor Account for SSH logins on port 50200 or 50201...

CVE-2022-32985

CVE-2022-32985 affects Nexans FTTO GigaSwitch industrial/office switches (HW v5) through vulnerable libnx_apl.so; SEC Consult and Red Hat/NVD describe a hardcoded backdoor account enabling SSH logins on ports 50200/50201. The issue stems from outdated components in HW version 5, with fixed versio...

CVE-2022-31210

An issue was discovered in Infiray IRAY-A8Z3 1.0.957. The binary file /usr/local/sbin/webproject/setparam.cgi contains hardcoded credentials to the web application. Because these accounts cannot be deactivated or have their passwords changed, they are considered to be backdoor accounts...

CVE-2022-31210

CVE-2022-31210 affects Infiray IRAY-A8Z3 v1.0.957. The binary /usr/local/sbin/webproject/set_param.cgi contains hardcoded credentials, creating backdoor accounts that cannot be disabled or password-changed. Red Hat and NVD entries corroborate the same description. No patch/version fix is indicate...

Malicious code in gumhecwixzkqfkbs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9676d03efb011da82ae28a0ec77c4b01b350571f48056753499f54b95a20392e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in bwpokydqiuagvjze (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 95f3b6df22f13be781514df2f5f903f055c07456898fd6a73396594c222e3a8f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in mflxtioqpeahbkzk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 538288efbc33c56624c40f86312ca7f5c45fd3c2770eac666f58877fbda1f0ca Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Hackers Exploiting Follina Bug to Deploy Rozena Backdoor

A newly observed phishing campaign is leveraging the recently disclosed Follina security vulnerability to distribute a previously undocumented backdoor on Windows systems. "Rozena is a backdoor malware that is capable of injecting a remote shell connection back to the attacker's machine," Fortine...