CVE-2025-5484

CVE-2025-5484 (SinoTrack GPS Receiver) affects SinoTrack devices with a central device management interface. The root cause is weak authentication: the username is the device identifier printed on the receiver and the default password is well-known and not enforced to be changed during setup. Thi...

CVE-2025-43866 Vantage6 Server JWT secret not cryptographically secure

vantage6 is an open-source infrastructure for privacy preserving analysis. The JWT secret key in the vantage6 server is auto-generated unless defined by the user. The auto-generated key is a UUID1, which is not cryptographically secure as it is predictable to some extent. This vulnerability is...

CVE-2025-40585

A vulnerability has been identified in Energy Services All versions with G5DFR. Affected solutions using G5DFR contain default credentials. This could allow an attacker to gain control of G5DFR component and tamper with outputs from the device...

SinoTrack IOT PC Platform 安全漏洞

SinoTrack IOT PC Platform is a location-based system from China-based SinoTrack. A security vulnerability exists in SinoTrack IOT PC Platform that stems from the default password not being forced to be changed, which could lead to a malicious actor obtaining a device identifier...

CVE-2025-49150 Cursor Agent Potentially Leaks Information using JSON schema

Cursor is a code editor built for programming with AI. Prior to 0.51.0, by default, the setting json.schemaDownload.enable was set to True. This means that by writing a JSON file, an attacker can trigger an arbitrary HTTP GET request that does not require user confirmation. Since the Cursor Agent...

CVE-2025-1699

An incorrect default permissions vulnerability was reported in the MotoSignature application that could result in unauthorized access...

CVE-2025-1699

An incorrect default permissions vulnerability was reported in the MotoSignature application that could result in unauthorized access...

SinoTrack GPS Devices Vulnerable to Remote Vehicle Control via Default Passwords

Two security vulnerabilities have been disclosed in SinoTrack GPS devices that could be exploited to control certain remote functions on connected vehicles and even track their locations. "Successful exploitation of these vulnerabilities could allow an attacker to access device profiles without...

Unspecified Vulnerability in SAMSUNG Cloud for Galaxy Watch

SAMSUNG Cloud for Galaxy Watch is a data backup tool from Samsung South Korea. SAMSUNG Cloud for Galaxy Watch suffers from a security vulnerability that stems from improper default permissions, and no details of the vulnerability have been provided...

The vulnerability of the microprogramming software of the Elspec G5 digital event recorder, related to the use of default administrative account information, allows a intruder to gain unauthorized access to the device.

The vulnerability of the microprogramming software of the Elspec G5 digital event recorder is related to the use of default administrative account information. Exploiting this vulnerability could allow an attacker operating remotely to gain unauthorized access to the device...

PT-2025-25200 · Sinotrack · Sinotrack Devices

Name of the Vulnerable Software and Affected Versions: SinoTrack devices affected versions not specified Description: The issue concerns a default password that is well-known and common to all SinoTrack devices, which can be used to authenticate to the central device management interface. A...

Motorola MotoSignature 安全漏洞

Motorola MotoSignature is a feature found in one of Motorola's mobile devices from Motorola, USA. A security vulnerability exists in Motorola MotoSignature that stems from improper default permissions, which could lead to unauthorized access...

CVE-2025-40585

A vulnerability has been identified in Energy Services All versions with G5DFR. Affected solutions using G5DFR contain default credentials. This could allow an attacker to gain control of G5DFR component and tamper with outputs from the device...

CVE-2025-40585

Summary: CVE-2025-40585 affects Siemens Energy Services for all versions using the G5DFR component, where default credentials enable an attacker to gain control of G5DFR and tamper with device outputs. What’s affected: Energy Services with G5DFR (default credentials exist). Cause: Use of default ...

CVE-2025-40585

A vulnerability has been identified in Energy Services All versions with G5DFR. Affected solutions using G5DFR contain default credentials. This could allow an attacker to gain control of G5DFR component and tamper with outputs from the device...

CVE-2025-40585

A vulnerability has been identified in Energy Services All versions with G5DFR. Affected solutions using G5DFR contain default credentials. This could allow an attacker to gain control of G5DFR component and tamper with outputs from the device...

PT-2025-24678 · Unknown · Energy Services

Name of the Vulnerable Software and Affected Versions: Energy Services versions with G5DFR Description: A vulnerability has been identified in Energy Services where affected solutions using G5DFR contain default credentials. This could allow an attacker to gain control of the G5DFR component and...

📄 INDAMED - MEDICAL OFFICE Demo Version Privilege Escalation / Default Credentials

INDAMED - MEDICAL OFFICE demo version revision 18544 II/20224 suffers from local privilege escalation and default credential vulnerabilities. SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Local Privilege Escalation a...

Siemens Energy Services 安全漏洞

Siemens Energy Services is an energy management system from Siemens Canada. A security vulnerability exists in Siemens Energy Services that stems from the G5DFR component containing default credentials that could lead to controlling the G5DFR component and tampering with device output...

VulnCheck KEV: CVE-2025-26793

The Web GUI configuration panel of Hirsch formerly Identiv and Viscount Enterphone MESH through 2024 ships with default credentials username freedom, password viscount. The administrator is not prompted to change these credentials on initial configuration, and changing the credentials...