CVE-2018-14984

The CVE-2018-14984 entry describes a vulnerability on the Leagoo Z5C (Android 6.0) where a pre-installed app, com.android.messaging, contains an exported BroadcastReceiver (TrackerSender). Any co-located app, even with no permissions, can send a crafted broadcast to this component, triggering pro...

CVE-2018-14985

The Leagoo Z5C Android device with a build fingerprint of sp7731c1h1032v4bird:6.0/MRA58K/android.20170629.214736:user/release-keys contains a pre-installed platform app with a package name of com.android.settings versionCode=23, versionName=6.0-android.20170630.092853 that contains an exported...

The vulnerability of the Cisco Video Surveillance Manager system allows a intruder to execute arbitrary commands with administrator privileges.

The vulnerability of the Cisco Video Surveillance Manager system is related to the use of pre-installed credentials. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands with administrator privileges...

The vulnerability of the Cisco Prime Collaboration Provisioning software installation component for centralized product management allows a hacker to gain access to the administrative web interface with administrator privileges.

The vulnerability of the Cisco Prime Collaboration Provisioning software installation component for centralized product management involves the use of pre-installed user accounts. Exploiting this vulnerability could allow an attacker to gain access to the administrative web interface with...

The vulnerability of Cisco Small Business network devices’ microprogramming software relates to the use of pre-installed credentials. This allows attackers to bypass authentication procedures and execute arbitrary commands with administrator privileges.

The vulnerability of Cisco Small Business network device software’s microprogramming lies in the use of pre-installed credentials. This vulnerability could allow a malicious actor to bypass authentication procedures and execute arbitrary commands with administrator privileges...

PHP-Proxy 5.1.0 - Local File Inclusion

PHP-Proxy 5.1.0 - Local File Inclusion Exploit Title: PHP-Proxy 5.1.0 - Local File Inclusion Date: 2018-11-13 Exploit Author: Ameer Pornillos Contact: https://ethicalhackers.club Vendor Homepage: https://www.php-proxy.com/ Software Link: https://www.php-proxy.com/download/php-proxy.zip Version:...

List of Operating Systems for OSINT (Open-Source Intelligence)

PenTestIT RSS Feed All of you must be well versed with the term OSINT and it's meaning. Wikipedia defines OSINT as the data collected from publicly available sources to be used in an intelligence context. There are multiple sources and tools which help you find this information. A good example is...

Flaws in Pre-Installed Apps Expose Millions of Android Devices to Hackers

Bought a new Android phone? What if I say your brand new smartphone can be hacked remotely? Nearly all Android phones come with useless applications pre-installed by manufacturers or carriers, usually called bloatware, and there's nothing you can do if any of them has a backdoor built-in—even if...

The vulnerability of microprogrammed software in Sixnet-Managed Industrial Switches and Stride-Managed Ethernet Switches arises from the use of pre-installed HTTP SSL/SSH keys. This allows a hacker to gain full control over the device.

The vulnerability of microprogrammed software in Sixnet-Managed Industrial Switches and Stride-Managed Ethernet Switches is related to the use of pre-installed HTTP SSL/SSH keys. Exploiting this vulnerability can allow a malicious actor to gain full control over the device remotely...

The vulnerability of the components ExportSettings.sh, updateWPS, RebootSystem, and vpnBasicSettings of the Intelbras NCLOUD 300 Wi-Fi router’s microprogramming system allows a hacker to gain access to the device with administrator privileges.

The vulnerabilities of the components ExportSettings.sh /cgi-bin/ExportSettings.sh, updateWPS /goform/updateWPS, RebootSystem /goform/RebootSystem, and vpnBasicSettings /goform/vpnBasicSettings of the Intelbras NCLOUD 300 Wi-Fi router software are related to the use of pre-installed registration...

The vulnerability of the Cisco Wide Area Application Services Software (WAAS) SNMP daemon allows a hacker to read any data available on the device through the SNMP protocol.

The vulnerability of the Cisco WAAS software package related to the use of pre-installed credentials. Exploiting this vulnerability allows a remote attacker to read any data available on the device through the SNMPv2c protocol...

The vulnerability of the MySQL server of Juniper Networks’ Junos Space network management platform allows a hacker to gain access with administrator privileges.

The vulnerability of the MySQL server of the Juniper Networks Junos Space network resource management platform is related to the use of pre-installed user accounts. Exploiting this vulnerability can allow a malicious actor to gain access with administrator privileges remotely...

The vulnerability of the microprogramming software of the Zyxel Multy X AC3000 lies in the lack of protection for the UART interface, which allows a hacker to gain access to the device with root privileges.

The vulnerability of the Zyxel Multy X AC3000 router’s microprogramming software lies in the lack of protection for the UART interface and the use of pre-installed credentials. Exploiting this vulnerability allows a malicious actor to gain access to the device with root privileges via the...

CVE-2017-17171

Summary: CVE-2017-17171 is a DoS vulnerability in some Huawei smartphones caused by improper processing of malicious parameters. A attacker could entice a user to install a malicious APK and leverage a pre-installed app with specific permissions to send crafted parameters to the phone driver, tri...

Hundreds of Android devices shipped with pre-installed malware

By Waqas It is commonly believed that a brand new handset would This is a post from HackRead.com Read the original post: Hundreds of Android devices shipped with pre-installed malware...

The vulnerability of the Tenda AC15 router’s microprogramming software allows a hacker to gain access to the device.

The vulnerability of the Tenda AC15 router’s microprogramming software is related to the use of pre-installed credentials. Exploiting this vulnerability can allow a malicious actor to gain access to the device remotely...

The vulnerability in the pre_connect_check.php web interface of the Seagate BlackArmor NAS software storage system allows a attacker to gain access to the device with root privileges.

The vulnerability of the backupmgt/preconnectcheck.php component of Seagate BlackArmor NAS network storage software is related to the use of a pre-installed account. Exploiting this vulnerability could allow an attacker, operating remotely, to gain full access to the device with root privileges...

The vulnerability of the executable file DTISQLInstaller.exe of the software package for interacting with QuicDoc and Office Therapy clients allows a perpetrator to gain access to the software.

The vulnerability of the DTISQLInstaller.exe executable file of the software package for interacting with QuicDoc and Office Therapy clients is related to the use of pre-installed user accounts. Exploiting this vulnerability can allow an attacker, operating remotely, to gain access to the softwar...

Security Advisory - Authentication Bypass Vulnerability in Some Pre-installed Apps on Huawei Phones

There is an authentication bypass vulnerability in some pre-installed apps on Huawei mobile phones due to insufficient validation on invocation requests. An attacker may trick a user into installing a malicious app which can invoke the open interfaces of the vulnerable apps to install any apps...

The vulnerability of the Master IP Camera01’s microprogramming software, which stems from the use of pre-installed credentials, allows a intruder to gain access to the device with root privileges.

The vulnerability of the Master IP Camera01 microprogramming system lies in the use of pre-set credentials. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain access to the device with root privileges...