CVE-2021-43284

CVE-2021-43284 affects Victure WR1200 devices (version 1.0.3 and earlier). The root SSH password remains the default value, “admin,” allowing an attacker to gain full control of the device via SSH regardless of whether the admin password was changed in the web interface. The connected records con...

Backdoor.Win32.Agent.ad Insecure Credential Storage

Discovery / credits: Malvuln - malvuln.com c 2021 Original source: https://malvuln.com/advisory/d2b933ebadd5c808ca4c68ae173e2d62.txt Contact: [email protected] Media: twitter.com/malvuln Threat: Backdoor.Win32.Agent.ad Vulnerability: Insecure Credential Storage Description: The malware listens ...

Moxa Mxview Network Management Software 信任管理问题漏洞

Moxa MXview is a network management software used to monitor and diagnose industrial networks.Moxa MXview is vulnerable to a hard-coded password vulnerability. An attacker could exploit this vulnerability to gain access through an account using the default password...

Cisco Energy Management Suite Default PostgreSQL Password Vulnerability

The version of Cisco Energy Management Suite installed on the remote host is prior to 5.2.3. It, therefore, potentially has a default password for the postgres account for the bundled PostgresSQL database. An unauthenticated, local attacker can exploit this to gain privileged or administrator...

GHSA-H8JC-JMRF-9H8F Argo CD Insecure default administrative password

In Argo CD versions 1.8.0 and prior, the default admin password is set to the argocd-server pod name. For insiders with access to the cluster or logs, this issue could be abused for privilege escalation, as Argo has privileged roles. A malicious insider is the most realistic threat, but pod names...

CVE-2021-37555

TX9 Automatic Food Dispenser v3.2.57 devices allow access to a shell as root/superuser, a related issue to CVE-2019-16734. To connect, the telnet service is used on port 23 with the default password of 059AnkJ for the root account. The user can then download the filesystem through preinstalled...

CVE-2021-37555

TX9 Automatic Food Dispenser v3.2.57 devices allow access to a shell as root/superuser, a related issue to CVE-2019-16734. To connect, the telnet service is used on port 23 with the default password of 059AnkJ for the root account. The user can then download the filesystem through preinstalled...

CVE-2021-37555

TX9 Automatic Food Dispenser v3.2.57 devices allow access to a shell as root/superuser, a related issue to CVE-2019-16734. To connect, the telnet service is used on port 23 with the default password of 059AnkJ for the root account. The user can then download the filesystem through preinstalled...

CVE-2021-37555

TX9 Automatic Food Dispenser v3.2.57 devices allow access to a shell as root/superuser, a related issue to CVE-2019-16734. To connect, the telnet service is used on port 23 with the default password of 059AnkJ for the root account. The user can then download the filesystem through preinstalled...

CVE-2021-37555

The CVE-2021-37555 entry describes TX9 Automatic Food Dispenser v3.2.57 with a root-access vulnerability via telnet on port 23 using the default root password 059AnkJ, enabling shell access and filesystem download through BusyBox tools (e.g., tar, nc). Related material (CVE-2019-16734) indicates ...

Insecure Default Initialization of Resource

As of v1.5.0, the default admin password is set to the argocd-server pod name. For insiders with access to the cluster or logs, this issue could be abused for privilege escalation, as Argo has privileged roles. A malicious insider is the most realistic threat, but pod names are not meant to be ke...

D-LINK DIR-3040 服务组件使用默认密码（CVE-2021-21818）

The DIR-3040 is an AC3000-based wireless internet router. Zebra is an IP routing manager that provides kernel routing table updates, interface lookups, and redistribution of routes between different routing protocols. The DIR-3040 runs this service by default on TCP port 2601 and can be accessed ...

Taiwan Secom Personnel Attendance Management Trust Management Issue Vulnerability

Taiwan Secom Personnel Attendance Management is an attendance management system from Taiwan Secom, China. Trust Management issue vulnerability, the vulnerability originates from the system using hard code admin default credentials, remote attackers can use the vulnerability to access the system...

LearningDigital Orca HCM digital learning platform 安全漏洞

LearningDigital Orca HCM digital learning platform is a digital learning platform from China-based LearningDigital. A security vulnerability exists in the Orca HCM digital learning platform, which stems from the platform's use of a weak factory default administrator password, which is hard-coded...

CVE-2021-35961 TAIWAN SECOM CO., LTD., Door Access Control and Personnel Attendance Management system - Use of Hard-coded Credentials

Dr. ID Door Access Control and Personnel Attendance Management system uses the hard-code admin default credentials that allows remote attackers to access the system through the default password and obtain the highest permission...

D-LINK DIR-3040 Libcli test environment hard-coded password vulnerability

Summary A hard-coded password vulnerability exists in the Libcli Test Environment functionality of D-LINK DIR-3040 1.13B03. A specially crafted network request can lead to code execution. An attacker can send a sequence of requests to trigger this vulnerability. Tested Versions D-LINK DIR-3040...

Huawei dg8045 - Authentication Bypass Vulnerability

Title: Huawei dg8045 - Authentication Bypass Author: Abdalrahman Gamal Vendor Homepage: www.huawei.com Version: dg8045 Hardware Version: VER.A POC: The default password of this router is the last 8 characters of the device's serial number which exist in the back of the device. An attacker can lea...

Atlassian Bugs Could Have Led to 1-Click Takeover

Atlassian, a platform used by 180,000 customers to engineer software and manage projects, could have been hijacked with a single click due to security flaws, researchers have disclosed. On Thursday, Check Point Research CPR published a report PDF outlining how an attacker could have exploited the...

Huawei DG8045 Authentication Bypass

Title: Huawei dg8045 - Authentication Bypass Date: 2020-06-24 Author: Abdalrahman Gamal Vendor Homepage: www.huawei.com Version: dg8045 Hardware Version: VER.A POC: The default password of this router is the last 8 characters of the device's serial number which exist in the back of the device. An...

Huawei dg8045 - Authentication Bypass

Title: Huawei dg8045 - Authentication Bypass Date: 2020-06-24 Author: Abdalrahman Gamal Vendor Homepage: www.huawei.com Version: dg8045 Hardware Version: VER.A POC: The default password of this router is the last 8 characters of the device's serial number which exist in the back of the device. An...