cve-2022-31749

CVE-2022-31749 by 1vere$k CVE-2022-31749 的简易 PoC 检测器，作者 1vere$k。 它利用了 WatchGuard SSH 接口中的一个参数注入漏洞。 该漏洞允许低权限用户将任意系统文件外泄到攻击者控制的 FTP 服务器。 幸运的是，脚本默认使用一个名为 status 的内置低权限用户。 假设 status 用户 使用 readonly 密码，这并非不合理，但并非必须。 该利用程序外泄用户文件 configd-hash.xml。 此文件包含哈希后的用户密码。 哈希只是无盐 MD4。@funoverip 早在2013年就描述了使用 hashca...

CVE-2020-36915

Adtec Digital SignEdje Digital Signage Player v2.08.28 contains multiple hardcoded default credentials that allow unauthenticated remote access to web, telnet, and SSH interfaces. Attackers can exploit these credentials to gain root-level access and execute system commands across multiple Adtec...

CVE-2020-36915 Adtec Digital SignEdje Digital Signage Player v2.08.28 Default Credentials

Adtec Digital SignEdje Digital Signage Player v2.08.28 contains multiple hardcoded default credentials that allow unauthenticated remote access to web, telnet, and SSH interfaces. Attackers can exploit these credentials to gain root-level access and execute system commands across multiple Adtec...

EUVD-2019-15017

Malware in sbrugna...

EUVD-2019-15018

Malware in sbrugna...

EUVD-2019-10138

Malware in sbrugna...

EUVD-2021-19342

Malware in sbrugna...

EUVD-2019-13525

Malware in sbrugna...

EUVD-2019-8215

Malware in sbrugna...

EUVD-2022-52225

Malicious code in bioql PyPI...

EUVD-2024-37380

Malicious code in bioql PyPI...

EUVD-2024-46546

Malicious code in bioql PyPI...

EUVD-2022-49616

Malicious code in bioql PyPI...

EUVD-2023-31185

Malicious code in bioql PyPI...

Arbitrary Argument Injection

Overview Affected versions of this package are vulnerable to Arbitrary Argument Injection via the commitCommand function. An attacker can create or overwrite arbitrary files by sending specially crafted requests through the SSH interface. Note: This vulnerability was fixed in version...

CVE-2024-5313

CWE-668: Exposure of the Resource Wrong Sphere vulnerability exists that exposes a SSH interface over the product network interface. This does not allow to directly exploit the product or make any unintended operation as the SSH interface access is protected by an authentication mechanism. Impact...

CVE-2023-27408

A vulnerability has been identified in SCALANCE LPE9403 All versions V2.1. The i2c mutex file is created with the permissions bits of -rw-rw-rw-. This file is used as a mutex for multiple applications interacting with i2c. This could allow an authenticated attacker with access to the SSH interfac...

CVE-2023-27409

A vulnerability has been identified in SCALANCE LPE9403 All versions V2.1. A path traversal vulnerability was found in the deviceinfo binary via the mac parameter. This could allow an authenticated attacker with access to the SSH interface on the affected device to read the contents of any file...

CVE-2022-46832

Use of a Broken or Risky Cryptographic Algorithm in SICK RFU62x firmware version 2.21 allows a low-privileged remote attacker to decrypt the encrypted data if the user requested weak cipher suites to be used for encryption via the SSH interface. The patch and installation procedure for the firmwa...

CVE-2022-46833

Use of a Broken or Risky Cryptographic Algorithm in SICK RFU63x firmware version v2.21 allows a low-privileged remote attacker to decrypt the encrypted data if the user requested weak cipher suites to be used for encryption via the SSH interface. The patch and installation procedure for the...