Circle with Disney WiFi Insecure Access Point Vulnerability

Summary An exploitable vulnerability exists in the WiFi Access Point feature of Circle with Disney running firmware 2.0.1. A series of WiFi packets can force Circle to setup an Access Point with default credentials. An attacker needs to send a series of spoofed “de-auth” packets to trigger this...

Microsoft Windows Default Credentials (PCI wordlist)

An SMB account on the remote Microsoft Windows host uses a common password for one or more accounts. These accounts may be used to gain access to the remote operating system and allow remote command execution. These accounts may belong to the Local Administrators or Domain Administrators groups...

Cisco product experience serious vulnerability, resulting in a large number of devices is facing a remote risk of attack-vulnerability warning-the black bar safety net

! Cisco in their IOS software that patches over 30 vulnerabilities, including a serious remote code execution vulnerability, the vulnerability can be hundreds of thousands of even millions of devices exposed on the network device initiates a remote attack. A total of three vulnerabilities are rat...

SSH Multiple Device Default Credentials (PCI)

The remote device is a device that uses a set of publicly known, default credentials. Knowing these, an attacker able to connect to the service can gain control of the device. WARNING: This plugin may run up to 4 hours depending on network conditions. TRUSTED...

VideoFlow Digital Video Protection (DVP) 2.10 - Hard-Coded Credentials

VideoFlow Digital Video Protection DVP 2.10 - Hard-Coded Credentials VideoFlow Digital Video Protection DVP 10 Authenticated Root Remote Code Execution Vendor: VideoFlow Ltd. Product web page: http://www.video-flow.com Affected version: 2.10 X-Prototype-Version: 1.6.0.2 System = Indicate if the D...

Default credentials

The Iptanus WordPress File Upload plugin before 4.3.3 for WordPress mishandles shortcode attributes...

Default credentials

The Zyxel Multy X AC3000 Tri-Band WiFi System device doesn't use a suitable mechanism to protect the UART. After an attacker dismantles the device and uses a USB-to-UART cable to connect the device, he can use the 1234 password for the root account to login to the system. Furthermore, an attacker...

Default credentials

An issue was discovered on D-Link DIR-601 B1 2.02NA devices. Being on the same local network as, but being unauthenticated to, the administrator's panel, a user can obtain the admin username and cleartext password in the response specifically, the configuration file restoredefault, which is...

Square 9 GlobalForms 6.2.x Blind SQL Injection Exploit

Exploit for php platform in category web applications Blind SQL Injection in Square 9 GlobalForms = 6.2.x CVE-2018-8820 Product Description GlobalFormsAr is Square 9as powerful web forms product. GlobalForms can live separate of GlobalSearch and runs on a separate Web Engine. Vulnerability Type...

Square 9 GlobalForms 6.2.x Blind SQL Injection

Blind SQL Injection in Square 9 GlobalForms = 6.2.x CVE-2018-8820 Product Description GlobalFormsAr is Square 9as powerful web forms product. GlobalForms can live separate of GlobalSearch and runs on a separate Web Engine. Vulnerability Type Blind SQL injection Vulnerability Description Square 9...

Cisco IOS XE Software Override Access Vulnerability

Cisco IOS XE Software is an operating system developed by Cisco for its network devices. A security vulnerability exists in Cisco IOS XE Software version 16.x, which arises from the use of a default username and password for an account with level 15 privileges. A remote attacker could use this...

NCR Aloha POS SMB Default Credentials

The remote NCR Aloha POS device is running with default credentials aloha / aloha. A remote, unauthenticated attacker could exploit this to take control of the system. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid108716; scriptversion"1.2"; scriptcvsdate"Date:...

CVE-2018-0150

A vulnerability in Cisco IOS XE Software could allow an unauthenticated, remote attacker to log in to a device running an affected release of Cisco IOS XE Software with the default username and password that are used at initial boot, aka a Static Credential Vulnerability. The vulnerability is due...

CVE-2018-0150

Cisco IOS XE Software Release 16.x is impacted by a Static Credential Vulnerability (Cisco Bug ID CSCve89880 ) caused by an undocumented user account with privilege level 15 access. This account possesses a default username and password used during initial boot. An unauthenticated, remote attacke...

CVE-2018-0150

A vulnerability in Cisco IOS XE Software could allow an unauthenticated, remote attacker to log in to a device running an affected release of Cisco IOS XE Software with the default username and password that are used at initial boot, aka a Static Credential Vulnerability. The vulnerability is due...

CVE-2018-0150

A vulnerability in Cisco IOS XE Software could allow an unauthenticated, remote attacker to log in to a device running an affected release of Cisco IOS XE Software with the default username and password that are used at initial boot, aka a Static Credential Vulnerability. The vulnerability is due...

Microsoft SQL Server Default Credentials (PCI wordlist)

The SQL Server has a common password for one or more accounts. These accounts may be used to gain access to the records in the database or even allow remote command execution. TRUSTED...

GE Centricity PACS RA1000 Authentication Bypass Vulnerability

GE Centricity PACS RA1000 is a General Electric GE image delivery and archiving system for the healthcare industry. An authentication bypass vulnerability exists in the GE Centricity PACS RA1000 that stems from the device using default credentials or hard-coded credentials. A remote attacker coul...

GE GEMNet License server (EchoServer) authentication bypass vulnerability

GE GEMNet License server EchoServer is a set of license servers for GE products from General Electric GE. A security vulnerability exists in the GE GEMNet License server EchoServer that arises from a device using default or hard-coded credentials. A remote attacker could use this vulnerability to...

GE Infinia/Infinia with Hawkeye 4 Authentication Bypass Vulnerability

GE Infinia/Infinia with Hawkeye 4 is an American General Electric GE medical imaging device using gamma rays equipped with the Hawkeye 4 system. A security vulnerability exists in GE Infinia/Infinia with Hawkeye 4 that stems from the program's use of default credentials or hard-coded credentials....