Default credentials

Jenkins Active Directory Plugin 2.19 and earlier allows attackers to log in as any user if a magic constant is used as the password...

PT-2020-16765

Name of the Vulnerable Software and Affected Versions The Relish Verve Connect VH510 device with firmware prior to 1.0.1.6L0516 Description The issue concerns undocumented default admin credentials for the web management interface. A remote attacker could exploit this to login and execute command...

Cisco SD-WAN Solution Software Static Credentials (cisco-sa-sdscred-HfWWfqBj)

A vulnerability exists in Cisco SD-WAN Solution Software due to the device having an account with a default, static password. An unauthenticated, local attacker can exploit this, by using the default credentials, to log in with root privileges. TRUSTED...

CVE-2020-16258

Winston 1.5.4 devices make use of a Monit service not managed during the normal user process which is configured with default credentials...

CVE-2020-16258

Winston 1.5.4 devices make use of a Monit service not managed during the normal user process which is configured with default credentials...

Default credentials

Winston 1.5.4 devices make use of a Monit service not managed during the normal user process which is configured with default credentials...

CVE-2020-16258

Winston 1.5.4 devices make use of a Monit service not managed during the normal user process which is configured with default credentials...

CVE-2020-16258

Winston 1.5.4 devices expose a Monit service that is not managed during the normal user process and is configured with default credentials. This creates a local-access vulnerability with potential partial confidentiality loss and complete availability impact, as indicated by CVSS metrics. The doc...

PT-2020-14849

Name of the Vulnerable Software and Affected Versions Winston version 1.5.4 Description The issue concerns the use of a Monit service in Winston devices, which is configured with default credentials and not managed during the normal user process. Recommendations For Winston version 1.5.4, conside...

Adtec Digital Multiple Products - Default Hardcoded Credentials Remote Root Vulnerability

Exploit Title: Adtec Digital Multiple Products - Default Hardcoded Credentials Remote Root Date: 2020-07-24 Exploit Author: LiquidWorm Software Link: https://www.adtecdigital.com / https://www.adtecdigital.com/support/documents-downloads Version: Multiple Adtec Digital Multiple Products - Default...

Adtec Digital Multiple Products - Default Hardcoded Credentials Remote Root

Exploit Title: Adtec Digital Multiple Products - Default Hardcoded Credentials Remote Root Date: 2020-07-24 Exploit Author: LiquidWorm Software Link: https://www.adtecdigital.com / https://www.adtecdigital.com/support/documents-downloads Version: Multiple Adtec Digital Multiple Products - Default...

Default credentials

tiki-login.php in Tiki before 21.2 sets the admin password to a blank value after 50 invalid login attempts...

This One Time on a Pen Test: Thanks for Sharing Your Wi-Fi

Each year, Rapid7 penetration testers complete hundreds of internally and externally based penetration testing service engagements. This post is part of an ongoing series featuring testimonials of what goes on beneath the hoodie. For more insights, check out our 2020 Under the Hoodie report. For...

ZeroShell Default Credentials (SSH)

The remote ZeroShell system is using known default credentials for the SSH login. SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Default credentials

A logic issue was addressed with improved restrictions. This issue is fixed in iOS 13.6 and iPadOS 13.6, Safari 13.1.2. A malicious attacker may cause Safari to suggest a password for the wrong domain...

Default credentials

If an attacker intercepts Thunderbird's initial attempt to perform automatic account setup using the Microsoft Exchange autodiscovery mechanism, and the attacker sends a crafted response, then Thunderbird sends username and password over https to a server controlled by the attacker. This...

HiSilicon Encoder Default Credentials (Telnet)

HiSilicon Encoder devices are using default credentials over Telnet. Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free...

Karel IP Phone IP1211 Web Management Panel - Directory Traversal

Exploit Title: Karel IP Phone IP1211 Web Management Panel - Directory Traversal Exploit Author: Berat Gokberk ISLER Date: 2020-09-01 CVE: N/A Type: Webapps Vendor Homepage: https://www.karel.com.tr/urun-cozum/ip1211-ip-telefon Version: IP1211 Details Directory traversal vulnerability on the Karel...

Default credentials

BOSH System Metrics Server releases prior to 0.1.0 exposed the UAA password as a flag to a process running on the BOSH director. It exposed the password to any user or process with access to the same VM through ps or looking at process details...

Default credentials

The Telnet service of Rubetek cameras RV-3406, RV-3409, and RV-3411 cameras firmware versions v342, v339 could allow an remote attacker to take full control of the device with a high-privileged account. The vulnerability exists because a system account has a default and static password. The Telne...