CVE-2023-36647

A hard-coded cryptographic private key used to sign JWT authentication tokens in ProLion CryptoSpike 3.0.15P2 allows remote attackers to impersonate arbitrary users and roles in web management and REST API endpoints via crafted JWT tokens...

CVE-2023-36651

Hidden and hard-coded credentials in ProLion CryptoSpike 3.0.15P2 allow remote attackers to login to web management as super-admin and consume the most privileged REST API endpoints via these credentials...

CVE-2023-36651

Hidden and hard-coded credentials in ProLion CryptoSpike 3.0.15P2 allow remote attackers to login to web management as super-admin and consume the most privileged REST API endpoints via these credentials...

CVE-2023-36647: Use of Hard-coded Credentials

A hard-coded cryptographic private key used to sign JWT authentication tokens in ProLion CryptoSpike 3.0.15P2 allows remote attackers to impersonate arbitrary users and roles in web management and REST API endpoints via crafted JWT tokens...

CVE-2023-36651: Use of Hard-coded Credentials

Hidden and hard-coded credentials in ProLion CryptoSpike 3.0.15P2 allow remote attackers to login to web management as super-admin and consume the most privileged REST API endpoints via these credentials...

ProLion CryptoSpike Security Vulnerability

ProLion CryptoSpike is ProLion's solution for detecting and combating suspicious activity. A security vulnerability exists in ProLion CryptoSpike version 3.0.15P2 that stems from the use of hard-coded encrypted private keys that sign JWT authentication tokens...

CVE-2023-36651

Summary: CVE-2023-36651 affects ProLion CryptoSpike 3.0.15P2. The issue arises from hidden and hard-coded credentials that let remote attackers log in to web management as super-admin and access the most privileged REST API endpoints. The available sources consistently describe the vulnerability ...

ProLion CryptoSpike Security Vulnerability

ProLion CryptoSpike is ProLion's solution for detecting and combating suspicious activity. A security vulnerability exists in ProLion CryptoSpike version 3.0.15P2 that stems from hidden and hard-coded credentials...

PT-2023-25655 · Prolion · Prolion Cryptospike

Name of the Vulnerable Software and Affected Versions: ProLion CryptoSpike version 3.0.15P2 Description: The issue concerns hidden and hard-coded credentials in the software, allowing remote attackers to login to web management as a super-admin. This access enables the consumption of the most...

Security Bulletin: IBM Integrated Management Module II (IMM2) is affected by First Failure Data Capture (FFDC) information disclosure (CVE-2018-9068)

Summary IBM Integrated Management Module II IMM2 has addressed the following First Failure Data Capture FFDC information disclosure vulnerability. Vulnerability Details CVEID: CVE-2018-9068 DESCRIPTION: Lenovo Integrated Management Module 2 IMM2 contains hard-coded credentials to access the SFTP...

PT-2023-31121 · Peplink · Peplink Balance Two

Name of the Vulnerable Software and Affected Versions: Peplink Balance Two versions prior to 8.4.0 Description: An issue was discovered in Peplink Balance Two where console port authentication uses hard-coded credentials. This allows an attacker with physical access and sufficient knowledge to...

CVE-2023-33413: Use of Hard-coded Credentials

The configuration functionality in the Intelligent Platform Management Interface IPMI baseboard management controller BMC implementation on Supermicro X11 and M11 based devices, with firmware versions through 3.17.02, allows remote authenticated users to execute arbitrary commands...

CVE-2023-39169: Use of Hard-coded Credentials

The affected devices use publicly available default credentials with administrative privileges...

NETSCOUT nGeniusPULSE Security Vulnerability

NetScout nGeniusPULSE is a comprehensive testing and infrastructure operational condition monitoring platform from NetScout, Inc. A security vulnerability exists in NETSCOUT nGeniusPULSE version 3.8 that stems from the use of hard-coded encryption keys...

CVE-2023-40463 Use of Hard-Coded Credentials

When configured in debugging mode by an authenticated user with administrative privileges, ALEOS 4.16 and earlier store the SHA512 hash of the common root password for that version in a directory accessible to a user with root privileges or equivalent access...

Sierra Wireless ALEOS Trust Management Issue Vulnerability

Sierra Wireless ALEOS AAF is Sierra Wireless Canada's framework for creating applications in Sierra Wireless AirLink gateways. A security vulnerability exists in Sierra Wireless ALEOS 4.16 and prior versions that stems from the use of hard-coded SSL certificates and private keys, which could allo...

CVE-2023-40463: Use of Hard-coded Credentials

When configured in debugging mode by an authenticated user with administrative privileges, ALEOS 4.16 and earlier store the SHA512 hash of the common root password for that version in a directory accessible to a user with root privileges or equivalent access...

CVE-2023-40464: Use of Hard-coded Cryptographic Key

Several versions of ALEOS, including ALEOS 4.16.0, use a hardcoded SSL certificate and private key. An attacker with access to these items could potentially perform a man in the middle attack between the ACEManager client and ACEManager server...

CVE-2023-28895

The password for access to the debugging console of the PoWer Controller chip PWC of the MIB3 infotainment is hard-coded in the firmware. The console allows attackers with physical access to the MIB3 unit to gain full control over the PWC chip. Vulnerability found on Škoda Superb III 3V3 - 2.0 TD...

CVE-2023-28895

The password for access to the debugging console of the PoWer Controller chip PWC of the MIB3 infotainment is hard-coded in the firmware. The console allows attackers with physical access to the MIB3 unit to gain full control over the PWC chip. Vulnerability found on Škoda Superb III 3V3 - 2.0 TD...