CVE-2017-9137

CVE-2017-9137 affects Ceragon FibeAir IP-10 wireless radios up to version 7.2.0, where the hidden mateidu account has a default password. The mateidu account can be accessed via both the web interface (read-only access) and SSH (Linux shell access), enabling an attacker to reach device settings o...

Ceragon FibeAir IP-10 7.2.0 Hidden User Backdoor Vulnerability

Exploit for hardware platform in category web applications + Credits: Ian Ling + Website: iancaling.com + Source: http://blog.iancaling.com/post/160817658078 Vendor: ================= https://www.ceragon.com Products: ====================== Ceragon FibeAir IP-10 =7.2.0 latest version Vulnerabilit...

Ceragon FibeAir IP-10 7.2.0 Hidden User Backdoor

Credits: Ian Ling + Website: iancaling.com + Source: http://blog.iancaling.com/post/160817658078 Vendor: ================= https://www.ceragon.com Products: ====================== Ceragon FibeAir IP-10 =7.2.0 latest version Vulnerability Types: =================== Hidden User Backdoor...

Oracle's PeopleSoft products was traced to the presence of unauthorized remote code execution vulnerability-vulnerability warning-the black bar safety net

Oracle PeopleSoft In a few months ago, I was fortunate enough to get to review Oracle's PeopleSoft solutions the opportunity to review object including PeopleSoft HRMS and PeopleTool. In addition to the few not recorded in the case of CVE addition, the network did not seem to me to provide how mu...

Default Password 'padmin' for 'padmin' Account

The account 'padmin' on the remote host has the default password 'padmin'. A remote attacker can exploit this issue to gain administrative access to the affected system. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. account = "padmin"; password = "padmin"; include'deprecatednasllevel.inc';...

CMVISION CM-NVST-MP08 Command Injection Vulnerability

The ddnsserver.cgi script on the device's webserver that runs as root is vulnerable to remote command execution by an authenticated user, with the default password being "admin:admin". The address GET parameter is fed to the command line by the CGI script without sanitization for semicolons,...

SolarWinds Log and Event Manager Postgres Database Security Bypass Vulnerability

SolarWinds Log and Event Manager is a log and event manager that provides real-time log analysis, memory event correlation, and threat attack response. A security bypass vulnerability exists in the Postgres database of SolarWinds Log and Event Manager 6.3.1, which stems from the database having a...

SolarWinds Log and Event Manager Command Execution Vulnerability (CNVD-2017-06863)

SolarWinds Log and Event Manager is a log and event manager that provides real-time log analysis, memory event correlation, and threat attack response. A command execution vulnerability exists in SolarWinds Log and Event Manager 6.3.1, which can be exploited to execute arbitrary commands by loggi...

SolarWinds Log and Event Manager Information Disclosure Vulnerability

SolarWinds Log and Event Manager is a log and event manager that provides real-time log analysis, memory event correlation, and threat attack response. An information disclosure vulnerability exists in SolarWinds Log and Event Manager 6.3.1, which can be exploited by a local attacker to log in to...

SolarWinds Log and Event Manager Elevation of Privilege Vulnerability

SolarWinds Log and Event Manager is a log and event manager that provides real-time log analysis, memory event correlation, and threat attack response. A privilege acquisition vulnerability exists in SolarWinds Log and Event Manager version 6.3.1. This vulnerability can be exploited by a local...

Zyxel WRE6505 DNS Hijacking Vulnerability

The Zyxel WRE6505 is a wireless AC750 range extender. The Zyxel WRE6505 device's root and admin accounts use the default TELNET password of 1234, resulting in easier DNS hijacking attacks by remote attackers by reconfiguring the built-in dnshijacker process...

CVE-2015-7246

D-Link DVG-N5402SP with firmware W1000CN-00, W1000CN-03, or W2000EN-00 has a default password of root for the root account and tw for the tw account, which makes it easier for remote attackers to obtain administrative access...

CVE-2015-7246

D-Link DVG-N5402SP with firmware W1000CN-00, W1000CN-03, or W2000EN-00 has a default password of root for the root account and tw for the tw account, which makes it easier for remote attackers to obtain administrative access...

CVE-2015-7246

CVE-2015-7246 affects D-Link DVG-N5402SP web management firmware W1000CN-00, W1000CN-03, and W2000EN-00. The issue is the presence of default credentials: root for the root account and tw for the tw account, enabling remote attackers to obtain administrative access via the device’s web interface....

Default credentials

ExaGrid appliances with firmware before 4.8 P26 have a default password of 1 inflection for the root shell account and 2 support for the support account in the web interface, which allows remote attackers to obtain administrative access via an SSH or HTTP session...

CVE-2016-1560

ExaGrid appliances with firmware before 4.8 P26 have a default password of 1 inflection for the root shell account and 2 support for the support account in the web interface, which allows remote attackers to obtain administrative access via an SSH or HTTP session...

CVE-2016-1560

ExaGrid appliances with firmware before 4.8 P26 have a default password of 1 inflection for the root shell account and 2 support for the support account in the web interface, which allows remote attackers to obtain administrative access via an SSH or HTTP session...

CVE-2016-1560

ExaGrid appliances running firmware before 4.8 P26 are affected by CVE-2016-1560 due to default credentials: root shell account password (inflection) and support account access via the web interface. This enables remote attackers to obtain administrative access through SSH or HTTP without exploit...

Trend Micro Threat Discovery Appliance 2.6.1062r1 logoff.cgi Directory Traversal

!/usr/local/bin/python """ Trend Micro Threat Discovery Appliance = 2.6.1062r1 logoff.cgi Directory Traversal Authentication Bypass Vulnerability Found by: Steven Seeley of Source Incite & Roberto Suggi Liverani - @malerisch - http://blog.malerisch.net/ File: TDAInstallationCD.2.6.1062r1.enUS.iso...

CVE-2017-7964

Zyxel WRE6505 devices have a default TELNET password of 1234 for the root and admin accounts, which makes it easier for remote attackers to conduct DNS hijacking attacks by reconfiguring the built-in dnshijacker process...