Default credentials

The management interface in ZyNOS firmware 3.62WK.6 on the Zyxel Zywall 2 device has a certain default password, which allows remote attackers to perform administrative actions...

Default credentials

changePW.php in AV Tutorial Script avtutorial 1.0 does not require authentication or knowledge of an old password for password changes, which allows remote attackers to change passwords for arbitrary users via a modified password parameter...

Default credentials

The Jedox Palo 1.5 client transmits the password in cleartext, which might allow remote attackers to obtain the password by sniffing the network, as demonstrated by starting Excel with the Palo plugin, opening a cube, and performing an Insert View...

Apple iOS Default SSH Password Vulnerability

This module exploits the default credentials of Apple iOS when it has been jailbroken and the passwords for the 'root' and 'mobile' users have not been changed. Module Options msf use exploit/apple/ios/ssh/cydiadefaultssh msf undefinedcydiadefaultssh show actions ...actions... msf...

CVE-2007-3446

The vulnerability CVE-2007-3446 affects BugMall Shopping Cart 2.5 and earlier. The issue is the default credentials: username “demo” and password “demo,” which allow remote attackers to obtain login access. This constitutes an authentication issue that can enable unauthorized access to the applic...

CVE-2007-3446: Undefined Security Weakness

BugMall Shopping Cart 2.5 and earlier has a default username "demo" and password "demo," which allows remote attackers to obtain login access...

Default credentials

The Random Cookie Password functionality in the loaduser function in cgi-bin/cgi-lib/subs.pl in web-app.org WebAPP before 0.9.9.7 does not clear the 1 username, 2 password, 3 usertheme, and 4 userlang cookies for unauthorized users, which has unknown impact and remote attack vectors...

Default credentials

The dosetpassword function in modules/chanserv/set.c in IRC Services before 5.0.60 preserves channel founder privileges across a channel password change ChanServ SET PASSWORD, which allows remote authenticated users to obtain the new password through automated e-mail, or perform privileged action...

Default credentials

NMASINST in Novell Modular Authentication Service NMAS 3.1.2 and earlier on NetWare logs its invoking command line to NMASINST.LOG, which might allow local users to obtain the admin username and password by reading this file...

Default credentials

config/general.php in Quick.Cart 2.2 and earlier uses a default username and password, which allows remote attackers to access the application via a login action to admin.php. NOTE: this can be leveraged to upload and execute arbitrary code...

CVE-2007-3139

config/general.php in Quick.Cart 2.2 and earlier uses a default username and password, which allows remote attackers to access the application via a login action to admin.php. NOTE: this can be leveraged to upload and execute arbitrary code...

CVE-2007-3139

config/general.php in Quick.Cart 2.2 and earlier uses a default username and password, which allows remote attackers to access the application via a login action to admin.php. NOTE: this can be leveraged to upload and execute arbitrary code...

CVE-2007-3139

The CVE-2007-3139 entry applies to Quick.Cart versions 2.2 and earlier. According to connected records, the root cause is in config/general.php where a default username and password are used, permitting remote attackers to authenticate via an admin.php login action. The practical consequence is t...

CVE-2007-3139: Undefined Security Weakness

config/general.php in Quick.Cart 2.2 and earlier uses a default username and password, which allows remote attackers to access the application via a login action to admin.php. NOTE: this can be leveraged to upload and execute arbitrary code...

Default credentials

The Vonage VoIP Telephone Adapter has a default administrator username "user" and password "user," which allows remote attackers to obtain administrative access...

CVE-2007-3047

The Vonage VoIP Telephone Adapter has a default administrator username "user" and password "user," which allows remote attackers to obtain administrative access...

CVE-2007-3047

The CVE-2007-3047 vulnerability affects the Vonage VoIP Telephone Adapter, where a default admin username/password of user/user enables remote administrative access. According to the documented metrics, the issue has a CVSS v2 base score of 10.0 (HIGH) with network access, no authentication, and ...

SNMPc Management Server Default Credentials

The SNMPc Management Server installation on the remote host uses a default username / password combination to control access to its administrative console. Knowing these, an attacker can gain control of the affected application. C Tenable Network Security, Inc. include"compat.inc"; if description...

CVE-2007-3047: Undefined Security Weakness

The Vonage VoIP Telephone Adapter has a default administrator username "user" and password "user," which allows remote attackers to obtain administrative access...

Default credentials

Apple Xserve Lights-Out Management before Firmware Update 1.0 on Intel hardware does not require a password for remote access to IPMI, which allows remote attackers to gain administrative access via unspecified requests with ipmitool...