CVE-2019-25021

An issue was discovered in Scytl sVote 2.1. Due to the implementation of the database manager, an attacker can access the OrientDB by providing admin as the admin password. A different password cannot be set because of the implementation in code...

Exploit for OS Command Injection in Linksys Re6500_Firmware

Description Belkin LINKSYS RE6500 devices before 1.0.012.001...

Evenroute IQrouter has an unspecified vulnerability (CNVD-2020-25366)

Evenroute IQrouter is an intelligent router from Evenroute USA. A security vulnerability exists in the 'diagsetpassword' function in the web panel in Evenroute IQrouter 3.3.1 and earlier versions. A remote attacker can exploit this vulnerability to arbitrarily change the root account password...

CVE-2020-11964

In IQrouter through 3.3.1, the Lua function diagsetpassword in the web-panel allows remote attackers to change the root password arbitrarily. Note: The vendor claims that this vulnerability can only occur on a brand-new network that, after initiating the forced initial configuration which has a...

PT-2018-14244 · Goahead +1 · Goahead +1

Name of the Vulnerable Software and Affected Versions: D-Link DIR-823G version 2018-09-19 Description: The issue allows unauthorized changes to the admin password through the GoAhead configuration, specifically by sending /HNAP1 SetPasswdSettings commands without proper authentication...

NetworkActiv Web Server 4.0 Pre-Alpha-3.7.2 - Username Denial of Service (PoC)

NetworkActiv Web Server 4.0 Pre-Alpha-3.7.2 - Username Denial of Service PoC Exploit Title: NetworkActiv Web Server 4.0 Pre-Alpha-3.7.2 - 'Username' Denial of Service PoC Discovery by: Victor Mondragón Discovery Date: 2018-08-30 Vendor Homepage: https://www.networkactiv.com/WebServer.html Softwar...

CVE-2016-8916

IBM Tivoli Storage Manager 5.5, 6.1-6.4, and 7.1 stores password information in a log file that could be read by a local user when a set password command is issued. IBM X-Force ID: 118472...

CVE-2016-8916

IBM Tivoli Storage Manager 5.5, 6.1-6.4, and 7.1 stores password information in a log file that could be read by a local user when a set password command is issued. IBM X-Force ID: 118472...

Rooted SSH/SFTP Daemon Default Login Credentials

Rooted SSH/SFTP Daemon installs with static default root credentials and does not prompt the user to change them. Title: Rooted SSH/SFTP Daemon Default Login Credentials Author: Larry W. Cashdollar, @larry0 OSVDB-ID: 110742 Date: 9/2/2014 Download:...

Session ID and remember me cookie should expire when LDAP user password is changed

Steps to reproduce Login as a normal Confluence user In another browser or in incognito mode, login as system administrator Go to Confluence Admin Manage Users and click on the user Click Set Password and set a different password for this user Refresh the page and the user can still access the pa...

Internet Information Service remote set password

""""""""""""""""""""""""""""""""""""""""""""""""""""""""""" """ :::::: :: :: :: :: :: :::: """ """ :: :: :: :: :::::: .. :::: :: """ """ ::::: ::: ::::: :: :: :: :: :: :::: """ """ :: :: :: :: : :: :: :: :: :: :: """ """ :::::: :: :: ::::: :: :::::: :: :: :::: rs.ir """ """ :: """ """ """...

Design/Logic Flaw

admin.php in UploadImage 1.0 does not check for the original password before making a change to a new password, which allows remote attackers to gain administrator privileges via the pass parameter in a nopass Set Password action...

Microsoft Windows SMB Blank Administrator Password

The remote host is running one of the Microsoft Windows operating systems. It was possible to log into it using the administrator account with a blank password. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid26918; scriptversion"1.20"; scriptcvsdate"Date: 2018/07/27...

Unpassworded 'mpi' Account

The account 'mpi' on the remote host does not have a password set. An attacker may use this to gain further privileges on this system. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. account = "mpi"; password = ""; include'deprecatednasllevel.inc'; include'compat.inc'; if description...

Sybase SQL sa Account Blank Password

The remote Sybase SQL server has the default 'sa' account enabled without any password. An attacker may use this flaw to execute commands against the remote host as well as read database content. C Tenable Network Security, Inc. This script is based on mssqlblankpassword.nasl which is C H D Moore...

Debian DSA-554-1 : sendmail - pre-set password

Hugo Espuny discovered a problem in sendmail, a commonly used program to deliver electronic mail. When installing 'sasl-bin' to use sasl in connection with sendmail, the sendmail configuration script use fixed user/pass information to initialise the sasl database. Any spammer with Debian systems...

[SECURITY] [DSA 554-1] New sendmail packages fix potential open relay

-------------------------------------------------------------------------- Debian Security Advisory DSA 554-1 [email protected] http://www.debian.org/security/ Martin Schulze September 27th, 2004 http://www.debian.org/security/faq -...

[SECURITY] [DSA 554-1] New sendmail packages fix potential open relay

-------------------------------------------------------------------------- Debian Security Advisory DSA 554-1 [email protected] http://www.debian.org/security/ Martin Schulze September 27th, 2004 http://www.debian.org/security/faq -...

Unpassworded 'EZsetup' Account

The account 'EZsetup' has no password set. An attacker may use it to gain further privileges on this system. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. account = "EZsetup"; include'deprecatednasllevel.inc'; include'compat.inc'; if description scriptid11241; scriptversion"1.36";...

Unpassworded 'guest' Account

The account 'guest' has no password set. An attacker may use it to gain further privileges on this system. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. account = "guest"; include'deprecatednasllevel.inc'; include'compat.inc'; if description scriptid11240; scriptversion"1.35";...