Multiple Vendors EAS Authentication Bypass

The remote EAS device permits root login using an SSH key with a publicly available private key. The private key was included in older copies of Monroe Electronics and Digital Alert Systems firmware. A remote attacker with access to the private key can bypass authentication of the root user...

金蝶EAS v7.5远程命令执行

简要描述： 金蝶 远程命令执行 详细说明： 金蝶EAS v7.5 全国使用的单位应该不少吧，而且涉及的内容应该是公司内核心机密吧。这个版本应该是最新的吧，应该是。。。吧。 到服务器上查看struts2 发现为很老版本了2.1.8.1（我会告诉你服务器是捅下来的么）。 该产品大部分链接需要登录才能访问，在没有帐号时相关权限只可远观而不可亵玩。 but http://localhost/pltiservice/service/findFavList.action 等几个action为接口，无须登录便可以访问。 没有帐号也可以执行漏洞代码。 漏洞证明：...

U.S Emergency broadcast System vulnerable to hackers

A major vulnerability has been discovered in the U.S. Emergency Alert System, researchers have warned.that could allow hackers to break into the system and broadcast fake messages to the United States. According to a new report by security firm IOActive, U.S. Emergency Alert System, the system us...

CVE-2013-4733

The web server on the Digital Alert Systems DASDEC EAS device before 2.0-2 and the Monroe Electronics R189 One-Net EAS device before 2.0-2 allows remote attackers to obtain sensitive configuration and status information by reading log files...

CVE-2013-4734

dasdecmkuser on the Digital Alert Systems DASDEC EAS device before 2.0-2 and the Monroe Electronics R189 One-Net EAS device before 2.0-2 generates predictable passwords, which might make it easier for attackers to obtain non-administrative access via unspecified vectors...

CVE-2013-0137

The default configuration of the Digital Alert Systems DASDEC EAS device before 2.0-2 and the Monroe Electronics R189 One-Net EAS device before 2.0-2 contains a known SSH private key, which makes it easier for remote attackers to obtain root access, and spoof alerts, via an SSH session...

Code injection

The administrative web server on the Digital Alert Systems DASDEC EAS device through 2.0-2 and the Monroe Electronics R189 One-Net EAS device through 2.0-2 uses predictable session ID values, which makes it easier for remote attackers to hijack sessions by sniffing the network. NOTE: VU662676...

Design/Logic Flaw

dasdecmkuser on the Digital Alert Systems DASDEC EAS device before 2.0-2 and the Monroe Electronics R189 One-Net EAS device before 2.0-2 generates predictable passwords, which might make it easier for attackers to obtain non-administrative access via unspecified vectors...

CVE-2013-4733: Insertion of Sensitive Information into Log File

The web server on the Digital Alert Systems DASDEC EAS device before 2.0-2 and the Monroe Electronics R189 One-Net EAS device before 2.0-2 allows remote attackers to obtain sensitive configuration and status information by reading log files...

CVE-2013-0137

The default configuration of the Digital Alert Systems DASDEC EAS device before 2.0-2 and the Monroe Electronics R189 One-Net EAS device before 2.0-2 contains a known SSH private key, which makes it easier for remote attackers to obtain root access, and spoof alerts, via an SSH session...

CVE-2013-4732

The administrative web server on the Digital Alert Systems DASDEC EAS device through 2.0-2 and the Monroe Electronics R189 One-Net EAS device through 2.0-2 uses predictable session ID values, which makes it easier for remote attackers to hijack sessions by sniffing the network. NOTE: VU662676...

CVE-2013-4733

The web server on the Digital Alert Systems DASDEC EAS device before 2.0-2 and the Monroe Electronics R189 One-Net EAS device before 2.0-2 allows remote attackers to obtain sensitive configuration and status information by reading log files...

CVE-2013-0137

Summary (CVE-2013-0137) The Digital Alert Systems DASDEC‑I/II and Monroe Electronics R189 One‑Net EAS devices released before firmware version 2.0‑2 contained a publicly available private SSH key in firmware, enabling remote attackers with SSH access to log in as root and spoof alerts. The issue ...

CVE-2013-4732

CVE-2013-4732 affects Digital Alert Systems DASDEC EAS device (versions 2.0-2) and Monroe Electronics R189 One-Net EAS device (versions 2.0-2). The issue is predictable session ID values in the administrative web server, enabling potential session hijacking by sniffing the network. Public documen...

CVE-2013-4733

The CVE-2013-4733 entry affects the web server component of the Digital Alert Systems DASDEC EAS device and the Monroe Electronics R189 One-Net EAS device, both versions prior to 2.0-2. An attacker can remotely read log files to obtain sensitive configuration and status information, exposing conf...

CVE-2013-4734

CVE-2013-4734 affects the DASDEC EAS device (Digital Alert Systems) before 2.0-2 and the Monroe Electronics R189 One-Net EAS device before 2.0-2. The underlying issue is that dasdec_mkuser generates predictable passwords, which could allow an attacker to obtain non-administrative access via unspe...

CVE-2013-4733

The web server on the Digital Alert Systems DASDEC EAS device before 2.0-2 and the Monroe Electronics R189 One-Net EAS device before 2.0-2 allows remote attackers to obtain sensitive configuration and status information by reading log files...

CVE-2013-4735

The CVE-2013-4735 issue affects the Digital Alert Systems DASDEC EAS device prior to 2.0-2 and Monroe Electronics R189 One-Net EAS prior to 2.0-2, which have a default administrative password. The underlying risk is that an attacker could remotely obtain access over an IP network due to this defa...

PT-2013-2123

Name of the Vulnerable Software and Affected Versions Digital Alert Systems DASDEC EAS device versions prior to 2.0-2 Monroe Electronics R189 One-Net EAS device versions prior to 2.0-2 Description The default configuration of the affected devices contains a known SSH private key, allowing remote...

PT-2013-5168

Name of the Vulnerable Software and Affected Versions Digital Alert Systems DASDEC EAS device versions prior to 2.0-2 Monroe Electronics R189 One-Net EAS device versions prior to 2.0-2 Description The issue allows remote attackers to obtain access via an IP network due to a default password for a...