Synology DiskStation Manager (DSM) Web Administration Interface Default Credentials

The web administration interface for the Synology DiskStation Manager DSM application running on the remote host uses a default blank password for the administrator account. A remote attacker can exploit this to gain administrative access to the web interface. C Tenable Network Security, Inc...

Moxa MiiNePort Blank Default Telnet Password

The remote device has a telnet service protected by blank default credentials that allow privileged access to the device. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if description scriptid93527; scriptversion"1.10";...

Default credentials

Tryton 3.x before 3.2.17, 3.4.x before 3.4.14, 3.6.x before 3.6.12, 3.8.x before 3.8.8, and 4.x before 4.0.4 allow remote authenticated users to discover user password hashes via unspecified vectors...

Loxone Smart Home Default Admin Login (HTTP)

The remote Loxone installation has default credentials set. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

BSNL Teracom Router Firmware Rewrite / Link Modification

Multiple Vulnerabilities in TERACOM ROUTER Author: Ajay Gowtham aka AJOXR Contact: gowtham.ajay5 at gmail.com Vulnerability Type: Insecure Upload File Permissions Affected Module: Upload Functionality Criticality: Medium Device Model: BSNL Teracom T2-B-Gawv1.4U10Y-BI is WiFi enabled ADSL2+...

BASHLITE Family Of Malware Infects 1 Million IoT Devices

More than one million consumer web-connected video cameras and DVRs are compromised by bot herders who use the devices for DDoS attacks, researchers say. According to Level 3 Threat Research Labs, a small malware family that goes by the names Lizkebab, BASHLITE, Torlus and Gafgyt is behind a web ...

SAP Hybris E-commerce Suite Default Credential Validation Bypass Vulnerability

SAP Hybris E-commerce Suite is e-commerce software and multichannel commerce solution. SAP Hybris E-commerce Suite Default Credential Authentication Bypass vulnerability. An attacker could exploit the vulnerability to gain unauthorized access to the affected application...

Shopify: Access to Splunk at https://apt.ec2.shopify.com:8089

Description: Default Splunk admin credentials were found at https://apt.ec2.shopify.com:8089 Default credentials login:admin password:changeme See pic 1 as POC Resolution: Change credentials Please let me know if you need some extra information. Sorry if this report if out of scope, i thought it...

NUUO Network Video Recorder Default Credentials (HTTP)

The remote NUUO Network Video Recorder web interface is using known default credentials. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Default credentials

The SurfaceFlinger service in Android 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-08-01 allows attackers to obtain sensitive information via a crafted application, related to lack of a default constructor in include/ui/FrameStats.h, aka internal bug 28592402...

Generic DVR Default Credentials Login Attempt

An attacker may attempt to gain access to the system by trying to log in using the default passwords, eventually finding the correct one. Successful exploitation may result in an unauthorized access...

Crestron Electronics DM-TXRX-100-STR web interface contains multiple vulnerabilities

Overview Crestron Electronics DM-TXRX-100-STR, version 1.2866.00026 and earlier, has a web management interface which contains multiple vulnerabilities, including authentication bypass, failure to restrict access to authorized users, use of hard-coded certificate, default credentials, and...

NetApp OnTap OS Default Credentials

The remote device is a NetApp OnTAP OS device that uses a set of known, default credentials. An attacker who is able to connect to the service can use these credentials to gain control of the device. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc';...

Default credentials

server/LockSettingsService.java in LockSettingsService in Android 6.x before 2016-07-01 allows attackers to modify the screen-lock password or pattern via a crafted application, aka internal bug 28163930...

The vulnerability of the microprogramming software of Schneider Electric’s Modicon Quantum programmable logic controllers allows a malicious individual to gain unauthorized access to the device.

The microprogrammed software of the 140NOE77111 module of Schneider Electric’s Modicon Quantum controller contains numerous login pairs—passwords that are pre-set by default. This allows any user who has access to the device via FTP protocol to gain authorized access to the device...

Default Password (ucspe) for 'ucspe' Account

The account 'ucspe' on the remote host has the password 'ucspe'. An attacker can exploit this issue to gain administrative access to the affected system. Note that Cisco Unified Computing System Platform Emulator is known to use these credentials to provide administrative access to the CLI...

IBM WebSphere DataPower XC10 Appliance Detection (HTTP)

Detects the installed version of IBM WebSphere DataPower XC10 Appliance. This script sends an HTTP GET request and tries to login via default credentials and fetches the version. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are...

Default credentials

Siemens SICAM PAS before 8.07 does not properly restrict password data in the database, which makes it easier for local users to calculate passwords by leveraging unspecified database privileges...

Default credentials

Symantec Endpoint Protection Manager SEPM 12.1 before RU6 MP5 allows remote authenticated users to discover credentials via a brute-force attack...

Riverbed SteelCentral NetProfiler & NetExpress Virtual Editions < 10.9.0 Multiple Vulnerabilities

The Riverbed SteelCentral NetProfiler and NetExpress virtual appliances are prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifie...