UBUNTU-CVE-2020-35480

An issue was discovered in MediaWiki before 1.35.1. Missing users accounts that don't exist and hidden users accounts that have been explicitly hidden due to being abusive, or similar that the viewer cannot see are handled differently, exposing sensitive information about the hidden status to...

MediaWiki Special:UserRights Code Issue Vulnerability

MediaWiki is a set of free and freely available web-based Wiki engines from the MediaWiki Wikimedia Foundation in the United States. It can be used to deploy in-house knowledge management and content management systems. MediaWiki has a code issue vulnerability that can be exploited by attackers t...

CVE-2020-12848

In Pydio Cells 2.0.4, once an authenticated user shares a file selecting the create a public link option, a hidden shared user account is created in the backend with a random username. An anonymous user that obtains a valid public link can get the associated hidden account username and password a...

CVE-2020-12848

CVE-2020-12848 (Pydio Cells 2.0.4) permits an authenticated user who shares a file via a public link to create a hidden backend account with a random username. An attacker with access to the public link can obtain the hidden username/password and log in, gaining actions not available to public sh...

Hardcoded credentials

DISPUTED An Incorrect Password Management issue was discovered in SMA Solar Technology products. Default passwords exist that are rarely changed. User passwords will almost always be default. Installer passwords are expected to be default or similar across installations installed by the same...

CVE-2017-9852

An Incorrect Password Management issue was discovered in SMA Solar Technology products. Default passwords exist that are rarely changed. User passwords will almost always be default. Installer passwords are expected to be default or similar across installations installed by the same company but a...

CVE-2017-9852

An Incorrect Password Management issue was discovered in SMA Solar Technology products. Default passwords exist that are rarely changed. User passwords will almost always be default. Installer passwords are expected to be default or similar across installations installed by the same company but a...

CVE-2017-9852

CVE-2017-9852 affects SMA Solar Technology products (notably Sunny Boy TLST-21/TL-21 and Sunny Tripower TL-10/TL-30). It describes an Incorrect Password Management issue: default passwords are rarely changed; user passwords are often default; installer passwords are often default or similar acros...

Ceragon FibeAir IP-10 7.2.0 Hidden User Backdoor Vulnerability

Exploit for hardware platform in category web applications + Credits: Ian Ling + Website: iancaling.com + Source: http://blog.iancaling.com/post/160817658078 Vendor: ================= https://www.ceragon.com Products: ====================== Ceragon FibeAir IP-10 =7.2.0 latest version Vulnerabilit...

Ceragon FibeAir IP-10 7.2.0 Hidden User Backdoor

Credits: Ian Ling + Website: iancaling.com + Source: http://blog.iancaling.com/post/160817658078 Vendor: ================= https://www.ceragon.com Products: ====================== Ceragon FibeAir IP-10 =7.2.0 latest version Vulnerability Types: =================== Hidden User Backdoor...

ManageEngine OpManager Remote Code Execution

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 'ManageEngine OpManager Remote Code Execution', 'Description' = %q This module exploits a default credential vulnerability in...

Visual Mining NetCharts Server Remote Code Execution Exploit

This Metasploit module exploits multiple vulnerabilities in Visual Mining NetCharts. First, a lack of input validation in the administration console permits arbitrary jsp code upload to locations accessible later through the web service. Authentication is typically required, however a 'hidden' us...

Visual Mining NetCharts Server Remote Code Execution

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 'Visual Mining NetCharts Server Remote Code Execution', 'Description' = %q This module exploits multiple vulnerabilities in Visual...

Visual Mining NetCharts Server Remote Code Execution

This module exploits multiple vulnerabilities in Visual Mining NetCharts. First, a lack of input validation in the administration console permits arbitrary jsp code upload to locations accessible later through the web service. Authentication is typically required, however a 'hidden' user is...

MobileIron Virtual Smartphone Platform - Privilege Escalation

MobileIron Virtual Smartphone Platform - Privilege Escalation MobileIron Virtual Smartphone Platform Privilege Escalation Exploit 0day ======================================================================== The MobileIron Virtual Smartphone Platform is the first solution to combine data-driven...

Useresponse 1.0.2 Backdoor / CSRF / Code Execution

!/usr/bin/python -------------------- | abuseresponse.py | -------------------- Useresponse = 1.0.2 privilege escalation & remote code execution exploit vendor: USWebStyle http://www.uswebstyle.com/ software: http://www.useresponse.com/ vulns found by bcoles @bclose and mrme @netninja exploit by...

Useresponse 1.0.2 - Privilege Escalation / Remote Code Execution

!/usr/bin/python -------------------- | abuseresponse.py | -------------------- Useresponse = 1.0.2 privilege escalation & remote code execution exploit vendor: USWebStyle http://www.uswebstyle.com/ software: http://www.useresponse.com/ vulns found by bcoles @bclose and mrme @netninja exploit by...

HP OpenView Performance Insight Server Backdoor Account

Nessus was able to log into the remote HP OpenView Performance Insight system using a hidden account. The 'hch908v' user, hard-coded in the 'com.trinagy.security.XMLUserManager' class, is hidden and has administrative privileges. A remote attacker could exploit this by logging in as the hidden us...

HP OpenView Performance Insight Server Backdoor Account

Binary data 5754.prm...

hidden admin user on every HP MSA2000 G3

Hi, i just found out that there is a hidden user on every HP MSA2000 G3 SAN out there: username: admin password: !admin this user doesnt show up in the user manager, and the password cannot be changed - looks like the perfect backdoor for everybody...