BSA-2019-866

Security Advisory ID : BSA-2019-866 Component : SANnav Revision : 1.0 Brocade SANnav versions before v2.0 usea hard-coded password, which could allowlocal authenticated attackers to access a back-end database and gain privileges. The vulnerability could be exploited only if the database service i...

CVE-2016-2360

Milesight IP security cameras through 2016-11-14 have a default root password in /etc/shadow that is the same across different customers' installations...

CVE-2016-2360

Milesight IP security cameras through 2016-11-14 have a default root password in /etc/shadow that is the same across different customers' installations...

CVE-2016-2360

Milesight IP security cameras (through 2016-11-14) have a default root password in /etc/shadow that is the same across different customers’ installations. Connected records corroborate this issue across multiple sources (Red Hat, CNVD, CVE databases) and describe the credential issue as a default...

Default Password ('scpuser') for 'scpuser' Account

The account 'scpuser' on the remote host has the password 'scpuser'. An attacker may leverage this issue to gain access, possibly as an administrator, to the affected system. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. account = "scpuser"; password = "scpuser";...

CVE-2019-12941

AutoPi Wi-Fi/NB and 4G/LTE devices before 2019-10-15 allows an attacker to perform a brute-force attack or dictionary attack to gain access to the WiFi network, which provides root access to the device. The default WiFi password and WiFi SSID are derived from the same hash function output input i...

CVE-2019-12941

AutoPi Wi-Fi/NB and 4G/LTE devices before 2019-10-15 allows an attacker to perform a brute-force attack or dictionary attack to gain access to the WiFi network, which provides root access to the device. The default WiFi password and WiFi SSID are derived from the same hash function output input i...

Puppet Enterprise x < 2018.1.9 / 2019.x.x < 2019.0.3 Default Password Vulnerabilities

The admin account is using a default password. An unauthenticated, remote attacker can exploit this gain privileged or administrator access to the system. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid129763; scriptversion"1.4";...

SecurityNotFound - 404 Page Not Found Webshell

Clone me! Clone or download the project: git clone https://github.com/CosasDePuma/SecurityNotFound.git SecurityNotFound cd SecurityNotFound "Installation" The src/404.php file should be located on the target server. That server must have the ability to execute .php files. Here is an example of so...

Western Digital My Book World II NAS 1.02.12 Hardcoded Credential Vulnerability

Western Digital My Book World II NAS versions 1.02.12 and below have a hard-coded ssh credential that allows for remote command execution. Exploit Title: Western Digital My Book World II NAS = 1.02.12 - Broken Authentication to RCE Google Dork: intitle:"My Book World Edition - MyBookWorld" Exploi...

Razer: Admin Management - Login Using Default Password - Leads to Image Upload Backdoor/Shell

The tester discovered an access control issue on a development server. Although this was not technically in scope of the bounty program and there was little risk to customer information, we granted an award as a token of appreciation for providing excellent PoCs and working with us on this...

PT-2019-17131 · Ibm · Ibm Security Key Lifecycle Manager

Name of the Vulnerable Software and Affected Versions: IBM Security Key Lifecycle Manager versions 3.0 through 3.0.1 Description: The issue is related to the default password strength requirements. By default, strong passwords are not required, making it easier for attackers to compromise user...

CVE-2019-16399

Western Digital WD My Book World through II 1.02.12 suffers from Broken Authentication, which allows an attacker to access the /admin/ directory without credentials. An attacker can easily enable SSH from /admin/systemadvanced.php?lang=en and login with the default root password welc0me...

CVE-2019-16399

The CVE affects Western Digital WD My Book World through II devices (firmware 1.02.12 and earlier). The vulnerability stems from Broken Authentication via a hardcoded SSH credential path, enabling an attacker to access the /admin/ directory without credentials and login with the default root pass...

Default Password for GPS Trackers

Many GPS trackers are shipped with the default password 123456. Many users don't change them. We just need to eliminate default passwords. This is an easy win. EDITED TO ADD 9/12: A California law bans default passwords starting in 2020...

Flaws in Over Half a Million GPS Trackers Expose Children Location Data

What if the tech intended to ensure that your kids, senior citizens, and pets are safe even when they're out of sight inadvertently expose them to stalkers? An estimated 600,000 GPS tracking devices for sale on Amazon and other large online merchants for $25–$50 have been found vulnerable to a...

Flaws in Over Half a Million GPS Trackers Expose Children Location Data

What if the tech intended to ensure that your kids, senior citizens, and pets are safe even when they're out of sight inadvertently expose them to stalkers? An estimated 600,000 GPS tracking devices for sale on Amazon and other large online merchants for $25–$50 have been found vulnerable to a...

Cisco UCS Director - default scpuser password (Metasploit)

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'net/ssh' require 'net/ssh/commandstream' class MetasploitModule "Cisco UCS Director default scpuser password", 'Description' = %q This module abuses a known...

Cisco UCS Director Default scpuser Password

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'net/ssh' require 'net/ssh/commandstream' class MetasploitModule "Cisco UCS Director default scpuser password", 'Description' = %q This module abuses a known...

Cisco UCS Director Default scpuser Password Exploit

This Metasploit module abuses a known default password on Cisco UCS Director. The 'scpuser' has the password of 'scpuser', and allows an attacker to login to the virtual appliance via SSH. This module has been tested with Cisco UCS Director virtual machines 6.6.0 and 6.7.0. Note that Cisco also...