Default credentials

IBM DataPower Gateway 7.6.0.0-7 throug 6.0.14 and 2018.4.1.0 through 2018.4.1.5 have a default administrator account that is enabled if the IPMI LAN channel is enabled. A remote attacker could use this account to gain unauthorised access to the BMC. IBM X-Force ID: 168883...

Unikrn: Staging Rabbitmq instance is exposed to the internet with default credentials

Description: RabbitMQ is an open-source message-broker software sometimes called message-oriented middleware that originally implemented the Advanced Message Queuing Protocol AMQP and has since been extended with a plug-in architecture to support Streaming Text Oriented Messaging Protocol STOMP,...

Default credentials

Improper handling of closenotify alerts can result in an out-of-bounds read in AsyncSSLSocket. This issue affects folly prior to v2019.11.04.00...

Default credentials

A vulnerability was found in Keycloak 7.x where the user federation LDAP bind type is none LDAP anonymous bind, any password, invalid or valid will be accepted...

Default credentials

piwigo has XSS in password.php...

PT-2019-6116

Name of the Vulnerable Software and Affected Versions FreeSWITCH versions 1.6.10 through 1.10.1 Description The issue is related to the use of default credentials in the event socket.conf.xml configuration file. This could allow a remote attacker to gain full control over the system...

CVE-2019-19469

In Zmanda Management Console 3.3.9, ZMCAdminAdvanced?form=adminTasks&action=Apply&command= allows CSRF, as demonstrated by command injection with shell metacharacters. This may depend on weak default credentials...

CVE-2019-19469

In Zmanda Management Console 3.3.9, ZMCAdminAdvanced?form=adminTasks&action=Apply&command= allows CSRF, as demonstrated by command injection with shell metacharacters. This may depend on weak default credentials...

Command injection

In Zmanda Management Console 3.3.9, ZMCAdminAdvanced?form=adminTasks&action=Apply&command= allows CSRF, as demonstrated by command injection with shell metacharacters. This may depend on weak default credentials...

Default credentials

relayopen in kernel/relay.c in the Linux kernel through 5.4.1 allows local users to cause a denial of service such as relay blockage by triggering a NULL allocpercpu result...

Default credentials

Progress Sitefinity 12.1 has a Weak Password Recovery Mechanism for a Forgotten Password because the HTTP Host header is mishandled...

zmanda_exploit

Zmanda Management Console 3.3.9 - RCE CVE-2019-19469 !Zman...

OpenWrt ustream-ssl library information disclosure vulnerability (CNVD-2019-42439)

OpenWrt is a Linux operating system for embedded devices. ustream-ssl is one of the cryptographic libraries. The ustream-ssl library in OpenWrt version 18.06.4 and 15.05.1 is vulnerable to an information disclosure vulnerability that can be exploited by an attacker to attack vulnerable components...

Default credentials

Moodle before 2.2.2 has a default repository capabilities issue where all repositories are viewable by all users by default...

Western Digital SSD Dashboard and SanDisk SSD Dashboard Trust Management Issue Vulnerability

Western Digital SSD Dashboard and SanDisk SSD Dashboard are both products of Western Digital, Inc. Western Digital SSD Dashboard is a dashboard software for managing and monitoring SSD Solid State Drive devices. SanDisk SSD Dashboard is a dashboard software for managing and monitoring SanDisk SSD...

Default credentials

The keygen.sh script in Shibboleth SP 2.0 located in /usr/local/etc/shibboleth by default uses OpenSSL to create a DES private key which is placed in sp-key.pm. It relies on the root umask default 22 instead of chmoding the resulting file itself, so the generated private key is world readable by...

EyeWitness - Tool To Take Screenshots Of Websites, Provide Some Server Header Info, And Identify Default Credentials If Possible

EyeWitness is designed to take screenshots of websites provide some server header info, and identify default credentials if known. EyeWitness is designed to run on Kali Linux. It will auto detect the file you give it with the -f flag as either being a text file with URLs on each new line, nmap xm...

Default credentials

Pagure: XSS possible in file attachment endpoint...

Default credentials

/usr/local/www/freeradiusviewconfig.php in the freeradius3 package before 0.15.73 for pfSense on FreeBSD allows a user with an XSS payload as password or username to execute arbitrary javascript code on a victim browser...

CVE-2018-18929

The Tightrope Media Carousel Seneca HDn Windows-based appliance 7.0.4.104 is shipped with a default local administrator username and password. This can be found by a limited user account in an "unattend.xml" file left over on the C: drive from the Sysprep process. An attacker with this username a...