CVE-2018-0008 Junos OS: commit script may allow unauthenticated root login upon reboot

An unauthenticated root login may allow upon reboot when a commit script is used. A commit script allows a device administrator to execute certain instructions during commit, which is configured under the system scripts commit stanza. Certain commit scripts that work without a problem during norm...

CVE-2017-17877

An issue was discovered in Valve Steam Link build 643. When the SSH daemon is enabled for local development, the device is publicly available via IPv6 TCP port 22 over the internet with stateless address autoconfiguration by default, which makes it easier for remote attackers to obtain access by...

CVE-2017-17877

An issue was discovered in Valve Steam Link build 643. When the SSH daemon is enabled for local development, the device is publicly available via IPv6 TCP port 22 over the internet with stateless address autoconfiguration by default, which makes it easier for remote attackers to obtain access by...

CVE-2017-17877

An issue was discovered in Valve Steam Link build 643. When the SSH daemon is enabled for local development, the device is publicly available via IPv6 TCP port 22 over the internet with stateless address autoconfiguration by default, which makes it easier for remote attackers to obtain access by...

Apple macOS 10.13.1 High Sierra - Blank Root Local Privilege Escalation Vulnerability

Exploit for macOS platform in category local exploits Source: https://twitter.com/lemiorhan/status/935578694541770752 & https://forums.developer.apple.com/thread/79235 "Dear @AppleSupport, we noticed a HUGE security issue at MacOS High Sierra. Anyone can login as "root" with empty password after...

CVE-2017-6692

A vulnerability in Cisco Ultra Services Framework Element Manager could allow an authenticated, remote attacker to log in to the device with the privileges of the root user, aka an Insecure Default Account Information Vulnerability. More Information: CSCvd85710. Known Affected Releases:...

Trango Altum AC600 Default Root Login Vulnerability

Exploit for hardware platform in category web applications + Credits: Ian Ling + Website: iancaling.com + Source: http://blog.iancaling.com/post/155395764003 Vendor: ================= https://www.trangosys.com/ Product: ====================== -Altum AC600 Vulnerability Details:...

Trango Altum AC600 Default Root Login

Credits: Ian Ling + Website: iancaling.com + Source: http://blog.iancaling.com/post/155395764003 Vendor: ================= https://www.trangosys.com/ Product: ====================== -Altum AC600 Vulnerability Details: ===================== Trango Altum AC600a2s have a default root login...

Command Execution Vulnerability in Shanghai Andatom IAM Gateway Console

Shanghai Andatom is a security solution provider engaged in the research and development of VPN security gateway and identity authentication products. A command execution vulnerability exists in the console of Shanghai Andante IAM gateway. The vulnerability allows an attacker to log in with the...

Design/Logic Flaw

Juniper Junos OS before 12.1X46-D50 on SRX Series devices reverts to "safe mode" authentication and allows root CLI logins without a password after a failed upgrade to 12.1X46, which might allow local users to gain privileges by leveraging use of the "request system software" command with the...

CVE-2016-1278

CVE-2016-1278 affects Juniper Junos OS on SRX Series devices. A failed upgrade to 12.1X46 can cause the device to revert to a safe mode with a flaw that allows root CLI logins without a password via the partition option of the upgrade, enabling local privilege escalation. Affected component is th...

MileSight camera default SSH root user vulnerability

MileSight camera is a network camera produced by Xiamen PulseVision Digital Technology Co. MileSight camera has a default SSH root user vulnerability. An attacker can use the vulnerability to log in to the device via root and obtain the highest privileges of the device...

CVE-2015-4545

EMC Isilon OneFS 7.1 before 7.1.1.8, 7.2.0 before 7.2.0.4, and 7.2.1 before 7.2.1.1 allows remote authenticated administrators to bypass a SmartLock root-login restriction by creating a root account and establishing a login session...

CVE-2015-4545

CVE-2015-4545 affects EMC Isilon OneFS (7.1, 7.2) and allows remote authenticated administrators to bypass the SmartLock root-login restriction by creating a root account and establishing a login session. The issue is described consistently across sources (NVD/NIST and CNVD/CVE records) as an ele...

Seagate Central 2014.0410.0026-F - Remote Facebook Access Token

!/usr/bin/python seagatecentralfacebook.py Seagate Central Remote Facebook Access Token Exploit Jeremy Brown jbrown3264/gmail May 2015 -Synopsis- Seagate Central stores linked Facebook account access tokens in /etc/archiveaccounts.ser and this exploit takes advantage of two bugs: 1 Passwordless...

F5 Networks BIG-IP : SSH vulnerability (K13600)

A platform-specific remote access vulnerability has been discovered that may allow a remote user to gain privileged access to affected systems using secure shell SSH. The vulnerability is caused by a configuration error, and is not the result of an underlying SSH defect. The following platforms a...

Airties Air6372SO Modem Web Interface Cross Site Scripting

Airties Air6372SO Modem Web Interface XSS/Iframe Injection Vulnerability My + Author : KnocKout Contact : [email protected] HomePage : http://cyber-warrior.Org - http://h4x0resec.blogspot.com Greetz: DaiMon,furty,BackDoor,EthicalHacker,BARCOD3,SZE©,VolqaN,Septemb0x, Unuttuklarýmýz affola...

ZPanel 10.0.0.2 Remote Command Execution Vulnerability

ZPanel version 10.0.0.2 suffers from a remote root command execution vulnerability. One of our expert team members email protected who is assigned to do the security audit of ZPanel code has found the follwoing security vulnerability with ZPanel 10.0.0.2 which will allow anyone to escalate the ro...

kexec-tools: Multiple security flaws by management of kdump core files and ramdisk images

The Red Hat mkdumprd script for kexec-tools, as distributed in the kexec-tools 1.x before 1.102pre-154 and 2.x before 2.0.0-209 packages in Red Hat Enterprise Linux, uses world-readable permissions for vmcore files, which allows local users to obtain sensitive information by inspecting the file...

Read configs to prevent root login

This plugin uses ssh to Read configs to prevent root login: Check for /etc/securettys show all non console, check if root login is not possible via SSH, check for SYSLOGSUENAB in /etc/login.defs, check for perm 0644 on /etc/securettys /etc/login.defs /etc/sshd/sshdconfig, check if rootsquash is...