8456 matches found
Emerson Patches Series of Flaws in Controllers Used in Oil and Gas Pipelines
Researchers have identified a wide range of vulnerabilities in remote terminal units manufactured by Emerson Process Management that are widely used in oil and gas pipelines and other applications. The vulnerabilities include a number of hidden functions in the RTUs, an authentication bypass and...
VDG Security SENSE 2.3.13 File Disclosure / Bypass / Buffer Overflow
SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Multiple critical vulnerabilities product: VDG Security SENSE formerly DIVA vulnerable version: 2.3.13 fixed version: unknown - no vendor confirmation impact: critical...
ZTE 831CII Multiple Vulnerablities
Exploit for hardware platform in category web applications Exploit Title: ZTE 831CII Multiple Vulnerablities Date: 11/3/2014 Exploit Author: Paulos Yibelo Vendor Homepage: zte.com.cn Software Link: - Version: - Tested on: Windows 7 CVE :- Hardcoded default misconfiguration - The modem comes with...
ZTE 831CII Multiple Vulnerablities
Hardcoded default misconfiguration - The modem comes with admin:admin user credintials. Stored XSS - http://192.168.1.1/psilan.cgi?action=saveðIpAddress=192.168.1.1ðSubnetMask=255.255.255.0&hostname=ZXDSL83C1II&domainname=home27;alert28029;//&enblUpnp=1&enblLan2=0 Any user browsing to...
ZTE 831CII Hardcoded Credential / XSS / CSRF
Hardcoded default misconfiguration - The modem comes with admin:admin user credintials. Stored XSS - http://192.168.1.1/psilan.cgi?action=saveðIpAddress=192.168.1.1ðSubnetMask=255.255.255.0&hostname=ZXDSL83C1II&domainname=home%27;alert%280%29;//&enblUpnp=1&enblLan2=0 Any user browsing to...
Softing FG-100 PB Hardcoded Backdoor
COMPASS SECURITY ADVISORY http://www.csnc.ch/en/downloads/advisories.html Product: Softing FG-100 PB Vendor: Softing AG www.softing.com CVD ID: CVE-2014-6617 Subject: Backdoor Account Risk: High Effect: Remotely exploitable Author: Ingmar Rosenhagen Daniel Marzin Johannes Klick Date: 05.11.2014...
Hardcoded credentials
The Herpin Time Radio aka com.herpin.time.radio application 2.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...
Hardcoded credentials
The Top Hangover Cures aka com.TopHangoverCures application 1.2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...
CVE-2014-5420
CareFusion Pyxis SupplyStation 8.1 with hardware test tool before 1.0.16 has a hardcoded application password, which makes it easier for remote authenticated users to obtain application-file access via unspecified vectors...
CVE-2014-5422
CareFusion Pyxis SupplyStation 8.1 with hardware test tool before 1.0.16 has a hardcoded service password, which makes it easier for remote attackers to obtain access via unspecified vectors...
Hardcoded credentials
CareFusion Pyxis SupplyStation 8.1 with hardware test tool before 1.0.16 has a hardcoded application password, which makes it easier for remote authenticated users to obtain application-file access via unspecified vectors...
Hardcoded credentials
CareFusion Pyxis SupplyStation 8.1 with hardware test tool 1.0.16 and earlier has a hardcoded database password, which makes it easier for local users to gain privileges by leveraging cabinet access...
Hardcoded credentials
CareFusion Pyxis SupplyStation 8.1 with hardware test tool before 1.0.16 has a hardcoded service password, which makes it easier for remote attackers to obtain access via unspecified vectors...
CVE-2014-5422
CVE-2014-5422 affects CareFusion Pyxis SupplyStation system 8.1 with hardware test tool prior to 1.0.16. The vulnerability is due to a hardcoded service password that grants admin privileges, enabling a remote attacker to gain access through unspecified vectors (remote exploitation possible if ne...
CVE-2014-5420
CVE-2014-5420 affects CareFusion Pyxis SupplyStation 8.1 with hardware test tool software versions up to 1.0.15. The vulnerability is hard-coded passwords in service and application accounts (and insecure temporary files) that could allow remote authenticated access to application files via unspe...
CVE-2014-5421
CareFusion Pyxis SupplyStation 8.1 with hardware test tool 1.0.16 and earlier has a hardcoded database password, which makes it easier for local users to gain privileges by leveraging cabinet access...
CVE-2014-5422
CareFusion Pyxis SupplyStation 8.1 with hardware test tool before 1.0.16 has a hardcoded service password, which makes it easier for remote attackers to obtain access via unspecified vectors...
CVE-2014-5420
CareFusion Pyxis SupplyStation 8.1 with hardware test tool before 1.0.16 has a hardcoded application password, which makes it easier for remote authenticated users to obtain application-file access via unspecified vectors...
CVE-2014-5421
CareFusion Pyxis SupplyStation system (version 8.1 with hardware test tool 1.0.16 and earlier) contains a hard-coded database password that can allow local users with cabinet access to gain privileges. CVE-2014-5421 is documented with a base vulnerability tied to hard-coded credentials; NVD notes...
NETIS DL4322D Multiple Vulnerabilities
NETIS DL4322D 300Mbps Wireless N ADSL2+ modem router suffers from cross site request forgery, cross site scripting, and denial of service vulnerabilities. Vulnerable Device: NETIS DL4322D 300Mbps Wireless N ADSL2+ Modem Router Multiple vulnerabilites Other models of netis may also suffer from thi...