CVE-2025-15554

Browser caching of LAPS passwords in Truesec’s LAPSWebUI before version 2.4 allows an attacker with access to a workstation to escalate their privileges via disclosure of local admin passwords...

July 9, 2024—KB5040438 (OS Build 25398.1009)

None None...

CVE-2024-37393

Multiple LDAP injections vulnerabilities exist in SecurEnvoy MFA before 9.4.514 due to improper validation of user-supplied input. An unauthenticated remote attacker could exfiltrate data from Active Directory through blind LDAP injection attacks against the DESKTOP service exposed on the...

April 9, 2024—KB5036909 (OS Build 20348.2402)

None None...

January 9, 2024—KB5034129 (OS Build 20348.2227)

None None...

May 9, 2023—KB5026370 (OS Build 20348.1726)

None None...

April 11, 2023—KB5025239 (OS Build 22621.1555)

None None...

Microsoft Windows: Presence of LAPS AdmPwd GPO Extension / CSE

This test checks the presence of LAPS AdmPwd GPO Extension / CSE on Windows hosts at least Windows 8.1. The Local Administrator Password Solution LAPS tool, which is free and supported software that allows an organization to automatically set randomized and unique local Administrator account...

Default Password (synnet) for 'debug' Account

The account 'debug' on the remote host uses the password 'synnet'. An attacker may use it to gain further privileges on this system. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. account = "debug"; password = "synnet"; include'deprecatednasllevel.inc'; include'compat.inc'; if description...

Default Password (zebra) for Zebra

The remote host is running Zebra, a routing daemon. The remote Zebra installation uses as its password the default, 'zebra'. An attacker may log in using this password and control the routing tables of the remote host. C Tenable Network Security, Inc. include"compat.inc"; if description...

iisPROTECT Unpassworded Administrative Interface

The remote host is running iisprotect, an IIS add-on to protect the pages served by this server. However, the administration module of this interface has not been password protected. As a result, an attacker may perform administrative tasks without any authentication. %NASLMINLEVEL 70300 C Tenabl...

Microsoft Windows Administrator Default Password Detection (W32/Deloder Worm Susceptibility)

W32/Deloder is a worm that tries to connect to a remote share by using a list of built-in administrator passwords. Nessus was able to connect to this host with one of these credentials. The worm W32/Deloder may use it to break into the remote host and upload infected data in the remote shares. C...

Axis Camera Default Password

The remote host seems to be an Axis Network Camera. It was possible to log into the remote host with the default credentials 'root/pass'. An attacker may use these credentials to trivially access the system. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. Script audit and contributions from...