CVE-2018-0130

A vulnerability in the use of JSON web tokens by the web-based service portal of Cisco Elastic Services Controller Software could allow an unauthenticated, remote attacker to gain administrative access to an affected system. The vulnerability is due to the presence of static default credentials f...

CVE-2018-0130: Initialization of a Resource with an Insecure Default

A vulnerability in the use of JSON web tokens by the web-based service portal of Cisco Elastic Services Controller Software could allow an unauthenticated, remote attacker to gain administrative access to an affected system. The vulnerability is due to the presence of static default credentials f...

CVE-2018-0130

A vulnerability in the use of JSON web tokens by the web-based service portal of Cisco Elastic Services Controller Software could allow an unauthenticated, remote attacker to gain administrative access to an affected system. The vulnerability is due to the presence of static default credentials f...

PT-2018-2500

Name of the Vulnerable Software and Affected Versions Cisco Elastic Services Controller Software Release 3.0.0 Description A vulnerability in the use of JSON web tokens by the web-based service portal of Cisco Elastic Services Controller Software could allow an unauthenticated, remote attacker to...

EMC vApp Manager Default Credentials

The EMC vApp Manager web application running on the remote host uses a default set of credentials 'smc' / 'smc'. An unauthenticated, remote attacker can exploit this issue to authenticate to the application and perform actions allowed by the default account. Specifically, the attacker can login a...

Default credentials

Progress Sitefinity 9.1 has XSS via file upload, because JavaScript code in an HTML file has the same origin as the application's own code. This is fixed in 10.1...

Nokia VitalQIP Web Client Default Credentials

The remote device appears to be a Nokia VitalQIP which contains a web interface with default credentials enabled. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid106719; scriptversion"$Revision: 1.1 $"; scriptcvsdate"$Date: 2018/02/09 21:55:16 $";...

PT-2018-1181

Name of the Vulnerable Software and Affected Versions GE Infinia/Infinia with Hawkeye 4 medical imaging systems all current versions Description The issue is related to the use of default or hard-coded credentials in the software. This could allow a remote attacker to bypass authentication and ga...

GE Medical Devices Vulnerability

OVERVIEW This advisory was originally posted to the HSIN ICS-CERT library on February 6, 2018, and is being released to the NCCIC/ICS-CERT website. Independent researcher Scott Erven submitted information regarding the potential use of default or hard-coded credentials in multiple GE Healthcare...

Default credentials

The performrequest function in /lib/echor/backplane.rb in echor 0.1.6 Ruby Gem allows local users to inject arbitrary code by adding a semi-colon in their username or password...

SSH Multiple Device Default Credentials

The remote device is a device that uses a set of publicly known, default credentials. Knowing these, an attacker able to connect to the service can gain control of the device. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if descriptio...

pfSense Default SSH Credentials

The remote device is a pfSense device that uses a set of known, default credentials. An attacker who is able to connect to the service can use these credentials to gain control of the device. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid106273; scriptversion"1.2";...

NEC Univerge SV9100/SV8100 WebPro 10.0 Remote Configuration Download

NEC Univerge SV9100/SV8100 WebPro 10.0 Remote Configuration Download Vendor: NEC Corporation Product web page: http://www.nec.com Affected version: WebPro =10.00 DSP Firmware Version: 12.11.00.02 Summary: NEC's UNIVERGEAr SV9100 is the unified communications UC solution of choice for small and...

NEC Univerge SV9100/SV8100 WebPro 10.0 - Configuration Download

NEC Univerge SV9100/SV8100 WebPro 10.0 Remote Configuration Download Vendor: NEC Corporation Product web page: http://www.nec.com Affected version: WebPro =10.00 DSP Firmware Version: 12.11.00.02 Summary: NEC's UNIVERGE® SV9100 is the unified communications UC solution of choice for small and...

Some Basic Rules for Securing Your IoT Stuff

Most readers here have likely heard or read various prognostications about the impending doom from the proliferation of poorly-secured "Internet of Things" or IoT devices. Loosely defined as any gadget or gizmo that connects to the Internet but which most consumers probably wouldn't begin to know...

Network Infrastructure Penetration Testing: SPARTA

SPARTA is a python GUI application which simplifies network infrastructure penetration testing by aiding the penetration tester in the scanning and enumeration phase. It allows the tester to save time by having point-and-click access to his toolkit and by displaying all tool output in a convenien...

Default credentials

Cobham Sea Tel 121 build 222701 devices allow remote attackers to obtain potentially sensitive information about valid usernames by reading the loginName lines at the js/userLogin.js URI. NOTE: default passwords for the standard usernames are listed in the product's documentation: Dealer with...

CVE-2018-5266

Cobham Sea Tel 121 build 222701 devices allow remote attackers to obtain potentially sensitive information about valid usernames by reading the loginName lines at the js/userLogin.js URI. NOTE: default passwords for the standard usernames are listed in the product's documentation: Dealer with...

D-Link DSL-6850U Multiple Vulnerabilities

Exploit for hardware platform in category web applications Vulnerabilities Summary The following advisory describes two 2 vulnerabilities found in D-Link DSL-6850U versions BZ1.00.01 – BZ1.00.09. D-Link DSL-6850U is a router “manufactured by D-Link for Bezeq in Israel” The vulnerabilities found...

D-Link DSL-6850U Router Remote Command Execution Vulnerability

The D-Link DSL-6850U is a wireless router product from AUO D-Link. The D-Link DSL-6850U router is vulnerable to remote command execution. As the router has a remote web management service enabled by default, a default credential support:support exists for this service and cannot be disabled. An...