Hardcoded credentials

NETGEAR D3600 devices with firmware 1.0.0.49 and D6000 devices with firmware 1.0.0.49 and earlier use the same hardcoded private key across different customers' installations, which allows remote attackers to defeat cryptographic protection mechanisms by leveraging knowledge of this key from...

Hardcoded credentials

Fonality previously trixbox Pro 12.6 through 14.1i before 2016-06-01 has a hardcoded password for the FTP account, which allows remote attackers to obtain access via a 1 FTP or 2 SSH connection...

CVE-2016-2364

The Chrome HUDweb plugin before 2016-05-05 for Fonality previously trixbox Pro 12.6 through 14.1i uses the same hardcoded private key across different customers' installations, which allows remote attackers to defeat cryptographic protection mechanisms by leveraging knowledge of this key from...

CVE-2016-2362

Fonality previously trixbox Pro 12.6 through 14.1i before 2016-06-01 has a hardcoded password for the FTP account, which allows remote attackers to obtain access via a 1 FTP or 2 SSH connection...

CVE-2016-2362

Fonality (formerly trixbox Pro) 12.6–14.1i before 2016-06-01 contains a hardcoded FTP password, enabling remote attackers to log in via FTP or SSH and gain access as the ‘nobody’ user. Multiple sources (NVD entry CVE-2016-2362, related CNVD/CVE records, and CERT entries) corroborate that this vul...

CVE-2015-8288

NETGEAR D3600 devices with firmware 1.0.0.49 and D6000 devices with firmware 1.0.0.49 and earlier use the same hardcoded private key across different customers' installations, which allows remote attackers to defeat cryptographic protection mechanisms by leveraging knowledge of this key from...

CVE-2015-8288

Netgear D6000 and D3600 routers running firmware 1.0.0.49 (and earlier) contain a hard-coded RSA private key and a hard-coded X.509 certificate/key pair, enabling remote attackers to bypass cryptographic protections, gain administrator access, perform man‑in‑the‑middle attacks, or decrypt passive...

Netgear D6000 and D3600 Hardcoded RSA Key Vulnerability

The Netgear D6000 and D3600 are wireless router products from American Netgear. The Netgear D6000 and D3600 device firmware uses hard-coded RSA keys, which allows remote attackers to exploit the vulnerability to conduct a man-in-the-middle attack with the keys, gain administrator access, and...

WooCommerce plugin for WordPress: source code security analysis report

Several vulnerabilities were discovered in WooThemes 'WooCommerce plugin for WordPress' software: File System Path Manipulation Using Global Variables Incorrect Newline Symbol Filtration in HTTP-response Headers Hardcoded Credentials...

CVE-2016-4328

MEDHOST Perioperative Information Management System aka PIMS or VPIMS before 2015R1 has hardcoded credentials, which makes it easier for remote attackers to obtain sensitive information via direct requests to the application database server...

Hardcoded credentials

MEDHOST Perioperative Information Management System aka PIMS or VPIMS before 2015R1 has hardcoded credentials, which makes it easier for remote attackers to obtain sensitive information via direct requests to the application database server...

CVE-2016-4328

MEDHOST Perioperative Information Management System aka PIMS or VPIMS before 2015R1 has hardcoded credentials, which makes it easier for remote attackers to obtain sensitive information via direct requests to the application database server...

CVE-2016-4328

CVE-2016-4328 affects MEDHOST PIMS (and related MEDHOST components) before 2015R1, where hard-coded credentials grant direct access to the customer database via the application server. Affected components include PIMS/VPIMS, with the CVSS indicating Critical impact (C/H, I/H, A/H) and NETWORK acc...

CVE-2016-2310

General Electric GE Multilink ML800, ML1200, ML1600, and ML2400 switches with firmware before 5.5.0 and ML810, ML3000, and ML3100 switches with firmware before 5.5.0k have hardcoded credentials, which allows remote attackers to modify configuration settings via the web interface...

Hardcoded credentials

General Electric GE Multilink ML800, ML1200, ML1600, and ML2400 switches with firmware before 5.5.0 and ML810, ML3000, and ML3100 switches with firmware before 5.5.0k have hardcoded credentials, which allows remote attackers to modify configuration settings via the web interface...

CVE-2016-2310

General Electric GE Multilink ML800, ML1200, ML1600, and ML2400 switches with firmware before 5.5.0 and ML810, ML3000, and ML3100 switches with firmware before 5.5.0k have hardcoded credentials, which allows remote attackers to modify configuration settings via the web interface...

CVE-2016-2310

General Electric GE Multilink ML800, ML1200, ML1600, and ML2400 switches with firmware before 5.5.0 and ML810, ML3000, and ML3100 switches with firmware before 5.5.0k have hardcoded credentials, which allows remote attackers to modify configuration settings via the web interface...

CVE-2016-2310

The CVE-2016-2310 issue affects GE Multilink switches (ML800, ML1200, ML1600, ML2400) with firmware before 5.5.0 and (ML810, ML3000, ML3100) with firmware before 5.5.0k. The underlying root cause is hardcoded credentials that allow remote attackers to modify configuration settings via the web int...

OneLogin SAML SSO <= 2.1.8 - Provisioned User Hardcoded Password

The OneLogin SAML SSO WordPress plugin was affected by a Provisioned User Hardcoded Password security vulnerability...

Sweet Baby Girl Cleanup 4 - Customized SSL, Dangerous filesystem permissions, Hardcoded secrets vulnerabilities

HackApp vulnerability scanner discovered that application Sweet Baby Girl Cleanup 4 published at the 'play' market has multiple vulnerabilities...