Hardcoded credentials

TOTOLINK A8000RU v7.1cu.643B20200521 was discovered to contain a hardcoded password for root stored in /etc/shadow...

CVE-2024-22894

An issue fixed in AIT-Deutschland Alpha Innotec Heatpumps V2.88.3 or later, V3.89.0 or later, V4.81.3 or later and Novelan Heatpumps V2.88.3 or later, V3.89.0 or later, V4.81.3 or later, allows remote attackers to execute arbitrary code via the password component in the shadow file...

CVE-2024-22894

An issue fixed in AIT-Deutschland Alpha Innotec Heatpumps V2.88.3 or later, V3.89.0 or later, V4.81.3 or later and Novelan Heatpumps V2.88.3 or later, V3.89.0 or later, V4.81.3 or later, allows remote attackers to execute arbitrary code via the password component in the shadow file...

Code injection

An issue fixed in AIT-Deutschland Alpha Innotec Heatpumps V2.88.3 or later, V3.89.0 or later, V4.81.3 or later and Novelan Heatpumps V2.88.3 or later, V3.89.0 or later, V4.81.3 or later, allows remote attackers to execute arbitrary code via the password component in the shadow file...

CVE-2024-24324

TOTOLINK A8000RU v7.1cu.643B20200521 was discovered to contain a hardcoded password for root stored in /etc/shadow...

CVE-2024-22894

An issue fixed in AIT-Deutschland Alpha Innotec Heatpumps V2.88.3 or later, V3.89.0 or later, V4.81.3 or later and Novelan Heatpumps V2.88.3 or later, V3.89.0 or later, V4.81.3 or later, allows remote attackers to execute arbitrary code via the password component in the shadow file...

CVE-2024-24324

CVE-2024-24324 affects TOTOLINK A8000RU, firmware version 7.1cu.643_B20200521, which is reported to store a hardcoded root password in /etc/shadow. The CVE has a high impact (CVSSv3.1: 9.8, CRITICAL) with network access, no user interaction, and no privileges required, per existing metrics. Conne...

Alpha Innotec Heatpumps Encryption Issues Vulnerabilities

Alpha Innotec Heatpumps is a heat pump from Alpha Innotec. A cryptographic issue vulnerability exists in Alpha Innotec Heatpumps wp2reg-V.3.88.0-9015 version and Novelan Heatpumps wp2reg-V.3.88.0-9015 version. A remote attacker could use this vulnerability to execute arbitrary code via the passwo...

CVE-2024-22894

An issue fixed in AIT-Deutschland Alpha Innotec Heatpumps V2.88.3 or later, V3.89.0 or later, V4.81.3 or later and Novelan Heatpumps V2.88.3 or later, V3.89.0 or later, V4.81.3 or later, allows remote attackers to execute arbitrary code via the password component in the shadow file...

CVE-2024-22894

CVE-2024-22894 affects AIT-Deutschland Alpha Innotec Heatpumps (V2.88.3+, V3.89.0+, V4.81.3+) and Novelan Heatpumps (V2.88.3+, V3.89.0+, V4.81.3+). The root cause is hardcoded credentials in the wp2reg-V3.88.0-9015 file, enabling remote attackers to execute arbitrary code via the password compone...

PT-2024-1487

Name of the Vulnerable Software and Affected Versions aiohttp versions prior to 3.9.2 python3-aiohttp versions prior to 3.6.2-1ubuntu1+esm3 python3-module-aiohttp versions prior to 3.9.5-alt1 python310-aiohttp versions prior to 3.9.3-1.1 Description aiohttp is an asynchronous HTTP client/server...

PT-2024-1304 · Alpha Innotec +1 · Alpha Innotec Heatpumps +1

Name of the Vulnerable Software and Affected Versions: Alpha Innotec Heatpumps versions prior to V2.88.3 Alpha Innotec Heatpumps versions prior to V3.89.0 Alpha Innotec Heatpumps versions prior to V4.81.3 Novelan Heatpumps versions prior to V2.88.3 Novelan Heatpumps versions prior to V3.89.0...

shadow-utils: possible password leak during passwd(1) change

A flaw was found in shadow-utils. When asking for a new password, shadow-utils asks the password twice. If the password fails on the second attempt, shadow-utils fails in cleaning the buffer used to store the first entry. This may allow an attacker with enough access to retrieve the password from...

RHEL 8 : shadow-utils (RHSA-2024:0417)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:0417 advisory. The shadow-utils packages include programs for converting UNIX password files to the shadow password format, as well as utilities for managing user a...

VulnCheck KEV: CVE-2021-46381

Local File Inclusion due to path traversal in D-Link DAP-1620 leads to unauthorized internal files reading /etc/passwd and /etc/shadow...

Ansible Playbook Error Message File Reader

This module will read the first line of a file based on an error message from ansible-playbook with sudo privileges. ansible-playbook takes a yaml file as input, and if there is an error, such as a non-yaml file, it outputs the line where the error occurs. This can be exploited to read the first...

EulerOS Virtualization 2.10.0 : shadow (EulerOS-SA-2023-3484)

According to the versions of the shadow package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - A flaw was found in shadow-utils. When asking for a new password, shadow-utils asks the password twice. If the password fails on t...

EulerOS 2.0 SP10 : shadow (EulerOS-SA-2023-3196)

According to the versions of the shadow package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - A flaw was found in shadow-utils. When asking for a new password, shadow-utils asks the password twice. If the password fails on the second...

EulerOS Virtualization 2.10.1 : shadow (EulerOS-SA-2023-3512)

According to the versions of the shadow package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - A flaw was found in shadow-utils. When asking for a new password, shadow-utils asks the password twice. If the password fails on t...

EulerOS Virtualization 2.11.1 : shadow (EulerOS-SA-2023-2742)

According to the versions of the shadow package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - In Shadow 4.13, it is possible to inject control characters into fields provided to the SUID program chfn change finger. Although ...