Default credentials

Remote Management and Screen Sharing in Apple Mac OS X 10.5 through 10.5.4, when used to set a password for a VNC viewer, displays additional input characters beyond the maximum password length, which might make it easier for attackers to guess passwords that the user believed were longer...

Default credentials

The Base Service Utilities component in IBM DB2 9.1 before Fixpak 5 retains a cleartext password in memory after the database connection that sent the password is fully established, which might allow local users to obtain sensitive information by reading a memory dump...

Openlink Virtuoso Server Default Credentials

The remote Openlink Virtuoso server is configured to use default credentials to control access. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if description scriptid33589; scriptversion"1.13";...

Default credentials

EMC Dantz Retrospect Backup Client 7.5.116 sends the password hash in cleartext at an unspecified point, which allows remote attackers to obtain sensitive information via a crafted packet...

Firebird Default Credentials

The version of Firebird on the remote host uses default credentials to control access. Knowing these, an attacker can gain administrative access to the affected application. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if description...

Default credentials

muCommander before 0.8.2 stores credentials.xml with insecure permissions, which allows local users to obtain credentials...

EMC DiskXtender默认凭据权限提升漏洞

BUGTRAQ ID: 28727 CVECAN ID: CVE-2008-0961 EMC DiskXtender是一款数据备份、迁移套件。 DiskXtender产品的主要组件包括文件系统管理器、MediaStor和证书服务器，这些组件都会创建可能远程访问的RPC端点。由于认证代码中包含有硬编码的登录和口令凭据，因此远程攻击者可以连接到这些RPC接口并使用这些凭据登录来绕过正常的认证过程，获得对DiskXtender服务器的管理访问。 EMC DiskXtender 6.20.60 EMC --- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：...

Design/Logic Flaw

The Advanced User Interface Pages in the ProST Web Management component on the Airspan WiMAX ProST have a certain default User ID and password, which makes it easier for remote attackers to obtain partial administrative access, a different vulnerability than CVE-2008-1262...

CVE-2008-1543

CVE-2008-1543 concerns the Airspan WiMAX ProST system. The affected component is the ProST Web Management interface, specifically the Advanced User Interface Pages, which use a default User ID and password. This configuration flaw can let remote attackers obtain partial administrative access, as ...

solidDB Default Credentials

The remote instance of solidDB uses known credentials to control access. With these, an attacker can gain administrative control of the affected application. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if description scriptid31681;...

Default credentials

Plone CMS 3.0.5, and probably other 3.x versions, places a base64 encoded form of the username and password in the ac cookie for the admin account, which makes it easier for remote attackers to obtain administrative privileges by sniffing the network...

Default credentials

Plone CMS before 3 places a base64 encoded form of the username and password in the ac cookie for all user accounts, which makes it easier for remote attackers to obtain access by sniffing the network...

Default credentials

bbanner.stm aka the login page on the Deutsche Telekom Speedport W500 DSL router allows remote attackers to obtain the logon password by reading the pwd field in the HTML source...

Default credentials

The ZyXEL P-660HW series router has "admin" as its default password, which allows remote attackers to gain administrative access...

Default credentials

goform/QuickStartc0 on the GoAhead Web Server on the FS4104-AW aka rooter VDSL device contains a password in the typepassword field, which allows remote attackers to obtain this password by reading the HTML source, a different vulnerability than CVE-2002-1603...

Default credentials

BEA WebLogic Server and Express 7.0 through 10.0 allows remote attackers to conduct brute force password guessing attacks, even when account lockout has been activated, via crafted URLs that indicate whether a guessed password is successful or not...

WinComLPD LPD Monitoring Server Default Credentials

The remote LPD Monitoring Server port is configured to use the default credentials to control access. Knowing these, an attacker can gain administrative control of the affected application. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid30186; scriptversion"$Revision...

Default credentials

Geert Moernaut LSrunasE allows local users to gain privileges by obtaining the encrypted password from a batch file, and constructing a modified batch file that specifies this password in the /password switch and specifies an arbitrary program in the /command switch...

Default credentials

Geert Moernaut LSrunasE 1.0 and Supercrypt 1.0 use the RC4 stream cipher without constructing a unique initialization vector IV, which makes it easier for local users to obtain cleartext passwords...

Default credentials

OKI C5510MFP Printer CU H2.15, PU 01.03.01, System F/W 1.01, and Web Page 1.00 sends the configuration of the printer in cleartext, which allows remote attackers to obtain the administrative password by connecting to TCP port 5548 or 7777...