Annotation tool: token forgery using jwt secret to claim super admin role

Although the annotator tool's source code is not directly provided in the repository a docker image is provided. From there it is easy to get access to the source code by either extracting the docker tar image, which can be exported from docker itself, or connecting to the container with an...

CVE-2023-0391: MGT-COMMERCE CloudPanel Shared Certificate Vulnerability and Weak Installation Procedures

While using the popular self-hosted web administration solution, CloudPanel from MGT-COMMERCE, Rapid7 researcher Tod Beardsley discovered three security concerns. The first, an issue involving the trustworthiness of the installation script provided by the vendor, was an instance of CWE-494:...

Authentication Bypass

alextselegidis/easyappointments is vulnerable to Authentication Bypass. The vulnerability exists due to the use of hard-coded credentials which allows an attacker to use the default password and bypass the login...

CVE-2023-26511

A Hard Coded Admin Credentials issue in the Web-UI Admin Panel in Propius MachineSelector 6.6.0 and 6.6.1 allows remote attackers to gain access to the admin panel Propiusadmin.php, which allows taking control of the affected system...

CVE-2023-26511

A Hard Coded Admin Credentials issue in the Web-UI Admin Panel in Propius MachineSelector 6.6.0 and 6.6.1 allows remote attackers to gain access to the admin panel Propiusadmin.php, which allows taking control of the affected system...

CVE-2023-26511

A Hard Coded Admin Credentials issue in the Web-UI Admin Panel in Propius MachineSelector 6.6.0 and 6.6.1 allows remote attackers to gain access to the admin panel Propiusadmin.php, which allows taking control of the affected system...

Propius MachineSelector 信任管理问题漏洞

Propius MachineSelector is Propius' Web server-client based remote maintenance tool for local setups on-premise or cloud-based in which companies can create, manage and control secure access to their machines. A security vulnerability exists in Propius MachineSelector versions 6.6.0 and 6.6.1,...

CVE-2023-0353

Akuvox E11 uses a weak encryption algorithm for stored passwords and uses a hard-coded password for decryption which could allow the encrypted passwords to be decrypted from the configuration file...

CVE-2023-27583 Panindex uses hard coded cyptographic key

PanIndex is a network disk directory index. In Panindex prior to version 3.1.3, a hard-coded JWT key PanIndex is used. An attacker can use the hard-coded JWT key to sign JWT token and perform any actions as a user with admin privileges. Version 3.1.3 has a patch for the issue. As a workaround, on...

CVE-2023-27583 Panindex uses hard coded cyptographic key

PanIndex is a network disk directory index. In Panindex prior to version 3.1.3, a hard-coded JWT key PanIndex is used. An attacker can use the hard-coded JWT key to sign JWT token and perform any actions as a user with admin privileges. Version 3.1.3 has a patch for the issue. As a workaround, on...

CVE-2023-0353 CVE-2023-0353

Akuvox E11 uses a weak encryption algorithm for stored passwords and uses a hard-coded password for decryption which could allow the encrypted passwords to be decrypted from the configuration file...

CVE-2023-0353 CVE-2023-0353

Akuvox E11 uses a weak encryption algorithm for stored passwords and uses a hard-coded password for decryption which could allow the encrypted passwords to be decrypted from the configuration file...

CVE-2023-0353

The connected documentation confirms CVE-2023-0353 affects Akuvox E11. The vulnerability arises from storing passwords with a weak encryption algorithm and decrypting them via a hard-coded key, enabling potential decryption of encrypted passwords from the device configuration. Impact is rated hig...

CVE-2023-0355

CVE-2023-0355 affects the Akuvox E11 doorbell camera. The vulnerability is described as the use of a hard-coded cryptographic key , which could allow an attacker to decrypt sensitive information. The CVE entry does not provide exploit details. The related ics advisory (IcsA-23-068-01) characteriz...

Android App "Wolt Delivery: Food and more" uses a hard-coded API key for an external service

Overview Android App "Wolt Delivery: Food and more" provided by Wolt uses a hard-coded API key for an external service CWE-798. Naoya Kurosawa of BroadBand Security, Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning...

PT-2023-21226 · Panindex · Panindex

Name of the Vulnerable Software and Affected Versions: PanIndex versions prior to 3.1.3 Description: The issue concerns a hard-coded JWT key PanIndex used in PanIndex. This allows an attacker to sign a JWT token and perform actions with admin privileges. Recommendations: For versions prior to...

PanIndex 信任管理问题漏洞

PanIndex is a directory index for netbooks. A security vulnerability exists in PanIndex versions prior to 3.1.3. An attacker exploited the vulnerability to sign a JWT token using a hard-coded JWT key and perform any action as a user with administrator privileges...

Wolt 信任管理问题漏洞

Wolt is a food and merchandise delivery platform by Finnish company Wolt. A security vulnerability exists in Wolt : Food Delivery/Demae Android App version 4.27.2 and earlier, which stems from the use of hard-coded API keys to provide external services, and can be exploited by an attacker to...

Akuvox E11 信任管理问题漏洞

Akuvox E11 is a SIP visual doorbell from Akuvox designed for villas, houses and apartments. The Akuvox E11 suffers from a trust management issue vulnerability that stems from the SSH server being enabled by default, accessible to the root user, and using hard-coded passwords...

Akuvox E11 安全漏洞

Akuvox E11 is a SIP visual doorbell from Akuvox designed for villas, houses and apartments. A security vulnerability exists in Akuvox E11 that stems from the fact that Akuvox E11 uses hard-coded encryption keys, which could allow an attacker to decrypt sensitive information...