717 matches found
CVE-2019-15023
A security vulnerability exists in Zingbox Inspector versions 1.294 and earlier, that results in passwords for 3rd party integrations being stored in cleartext in device configuration...
Security feature bypass
A security vulnerability exists in Zingbox Inspector versions 1.294 and earlier, that results in passwords for 3rd party integrations being stored in cleartext in device configuration...
Insecure Password Storage in Zingbox Inspector
A security vulnerability exists in Zingbox Inspector that results in passwords for 3rd party integrations being stored in cleartext in device configuration. Ref: CVE-2019-15023 The vulnerability allows for the viewing of plaintext credentials stored within the Zingbox Inspector software and store...
Lexmark Printer Multiple Access Control Vulnerabilities (TE924)
Some Lexmark devices do not have the ability to restrict access to the SE and shortcut menus. Therefore unauthenticated users could access this information. Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the...
The Fully Remote Attack Surface of the iPhone
Posted by Natalie Silvanovich, Project Zero While there have been several rumours and reports of fully remote vulnerabilities affecting the iPhone being used by attackers in the last couple of years, limited information is available about the technical details of these vulnerabilities, as well as...
Input validation
A vulnerability in Cisco Small Business SPA500 Series IP Phones could allow a physically proximate attacker to execute arbitrary commands on the device. The vulnerability is due to improper input validation in the device configuration interface. An attacker could exploit this vulnerability by...
Code injection
In GE Aestiva and Aespire versions 7100 and 7900, a vulnerability exists where serial devices are connected via an added unsecured terminal server to a TCP/IP network configuration, which could allow an attacker to remotely modify device configuration and silence alarms...
CVE-2019-10966
In GE Aestiva and Aespire versions 7100 and 7900, a vulnerability exists where serial devices are connected via an added unsecured terminal server to a TCP/IP network configuration, which could allow an attacker to remotely modify device configuration and silence alarms...
D-Link Central WiFiManager SQL injection
This module exploits a SQLi vulnerability found in D-Link Central WiFi Manager CWM100 before v1.03R0100BETA6. The vulnerability is an exposed API endpoint that allows the execution of SQL queries without authentication, using this vulnerability, it's possible to retrieve usernames and password...
CVE-2017-8229
Amcrest IPM-721S V2.420.AC00.16.R.20160909 devices allow an unauthenticated attacker to download the administrative credentials. If the firmware version V2.420.AC00.16.R 9/9/2016 is dissected using binwalk tool, one obtains a user-x.squashfs.img.extracted archive which contains the filesystem set...
Design/Logic Flaw
The ABB HMI components implement hidden administrative accounts that are used during the provisioning phase of the HMI interface. These credentials allow the provisioning tool "Panel Builder 600" to flash a new interface and Tags MODBUS coils mapping to the HMI. These credentials are the idal123...
CVE-2018-10694
An issue was discovered on Moxa AWK-3121 1.14 devices. The device provides a Wi-Fi connection that is open and does not use any encryption mechanism by default. An administrator who uses the open wireless connection to set up the device can allow an attacker to sniff the traffic passing between t...
Siemens SIMATIC S7-1200 CPU < 4.2.3 Authentication Bypass
Binary data 720163.prm...
Sierra Wireless AirLink ES450 ACEManager upload.cgi Unverified Password Change Vulnerability
Summary An exploitable unverified password change vulnerability exists in the ACEManager upload.cgi functionality of Sierra Wireless AirLink ES450 FW 4.9.3. A specially crafted HTTP request can cause a unverified device configuration change, resulting in an unverified change of the user password ...
CVE-2019-1797
A vulnerability in the web-based management interface of Cisco Wireless LAN Controller WLC Software could allow an unauthenticated, remote attacker to conduct a cross-site request forgery CSRF attack and perform arbitrary actions on the device with the privileges of the user, including modifying...
CVE-2019-1797 Cisco Wireless LAN Controller Software Cross-Site Request Forgery Vulnerability
A vulnerability in the web-based management interface of Cisco Wireless LAN Controller WLC Software could allow an unauthenticated, remote attacker to conduct a cross-site request forgery CSRF attack and perform arbitrary actions on the device with the privileges of the user, including modifying...
CVE-2019-1797
Cisco Wireless LAN Controller (WLC) software contains a Cross-Site Request Forgery (CSRF) vulnerability in the web-based management interface. The issue arises from insufficient CSRF protections, allowing an unauthenticated attacker to lure a user into a crafted link and perform arbitrary actions...
CVE-2019-1797 Cisco Wireless LAN Controller Software Cross-Site Request Forgery Vulnerability
A vulnerability in the web-based management interface of Cisco Wireless LAN Controller WLC Software could allow an unauthenticated, remote attacker to conduct a cross-site request forgery CSRF attack and perform arbitrary actions on the device with the privileges of the user, including modifying...
Grandstream GXP16xx Information Disclosure Vulnerability
The Grandstream GXP16xx VoIP is a 16XX series IP phone from Grandstream. An information disclosure vulnerability exists in /cgi-bin/api-getlinestatus in the Grandstream GXP16xx 1.0.4.128, which can be exploited by an attacker to dump the device's configuration in plaintext via a malformed input...