785 matches found
CVE-2016-5333
VMware Photos OS OVA 1.0 before 2016-08-14 has a default SSH public key in an authorizedkeys file, which allows remote attackers to obtain SSH access by leveraging knowledge of the private key...
SSH Key Persistence
This module will add an SSH key to a specified user or all, to allow remote login via SSH at any time. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'sshkey' class MetasploitModule 'SSH Key Persistence',...
Ubiquiti airOS - Arbitrary File Upload (Metasploit)
Exploit for unix platform in category remote exploits This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Ubiquiti airOS Arbitrary File Upload', 'Description' = %q This module exploits a pre-auth fi...
Ubiquiti airOS - Arbitrary File Upload (Metasploit)
This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Ubiquiti airOS Arbitrary File Upload', 'Description' = %q This module exploits a pre-auth file upload to install a new root user to /etc/passwd an...
Ubiquiti airOS Arbitrary File Upload
This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Ubiquiti airOS Arbitrary File Upload', 'Description' = %q This module exploits a pre-auth file upload to install a new root user to /etc/passwd an...
Ubiquiti airOS Arbitrary File Upload
This module exploits a pre-auth file upload to install a new root user to /etc/passwd and an SSH key to /etc/dropbear/authorizedkeys. FYI, /etc/passwd,dropbear/authorizedkeys will be overwritten. /etc/persistent/rc.poststart will be overwritten if PERSISTETC is true. This method is used by the "m...
CVE-2016-2353
The Accellion File Transfer Appliance FTA before FTA91240 allows local users to add an SSH key to an arbitrary group, and consequently gain privileges, via unspecified vectors...
CVE-2016-2353
The Accellion File Transfer Appliance FTA before FTA91240 allows local users to add an SSH key to an arbitrary group, and consequently gain privileges, via unspecified vectors...
Authentication flaw
The Accellion File Transfer Appliance FTA before FTA91240 allows local users to add an SSH key to an arbitrary group, and consequently gain privileges, via unspecified vectors...
CVE-2016-2353
The connected OpenVAS entry identifies multiple vulnerabilities in Accellion File Transfer Appliance (FTA) prior to FTA_9_12_40, including local privilege escalation by allowing a local user to add an SSH key to an arbitrary group, enabling privilege gain. The CVE-2016-2353 entry likewise describ...
CVE-2016-2353
The Accellion File Transfer Appliance FTA before FTA91240 allows local users to add an SSH key to an arbitrary group, and consequently gain privileges, via unspecified vectors...
CVE-2016-2353: Undefined Security Weakness
The Accellion File Transfer Appliance FTA before FTA91240 allows local users to add an SSH key to an arbitrary group, and consequently gain privileges, via unspecified vectors...
ExaGrid Private SSH Key Removed
ExaGrid has removed a private SSH key and weak, hardcoded credentials shipping with all of its disk-based storage appliances. Updated firmware has been available since March 24 and storage and security managers are urged to update devices to version 4.8 P26. Researcher James Lee of Rapid7 private...
Cisco UCS Invicta Default SSH Key Vulnerability
A vulnerability in the implementation of intra-process communication for Cisco UCS Invicta Software could allow an unauthenticated, remote attacker to connect to the affected system with the privileges of the root user. The vulnerability is due to the presence of a default SSH private key that is...
Researcher Outlines Multiple Vulnerabilities in Quanta Routers
Routers manufactured by Quanta are riddled with critical vulnerabilities–backdoors, a hardcoded SSH key, and remote code execution flaws, to name a few–that won’t be patched because the company considers the product end of life. Researcher Pierre Kim found the flaws and reasons that the flaws are...
Ubiquiti airOS Arbitrary File Upload
This module exploits a pre-auth file upload to install a new root user to /etc/passwd and an SSH key to /etc/dropbear/authorizedkeys. FYI, /etc/passwd,dropbear/authorizedkeys will be overwritten. /etc/persistent/rc.poststart will be overwritten if PERSISTETC is true. This method is used by the "m...
Redis event a comprehensive analysis-vulnerability warning-the black bar safety net
redis unauthorized access has not been valued, until the 1 1 on No. 4, and in this article on being broke: the redis you can write into the SSH Key and then control the server, the security personnel started a lot of attention to this event. 0×0 1 vulnerability profile Exposed in public of redis ...
Redis unauthorized access with SSH key file use analysis: ZoomEye the latest global exclusive data V2-vulnerability warning-the black bar safety net
Updates ! 2. Vulnerability overview Redis by default, it will bind on 0.0.0.0:6 3 7 9, This will be the Redis service exposed to the public Internet, if there is no open authentication, can cause any user can access the target server is not authorized to access Redis and read the Redis data...
Cisco Application Policy Infrastructure Controller Elevation of Privilege Vulnerability
Cisco Application Policy Infrastructure Controller devices are an application-centric infrastructure ACI controller product. Cisco Application Policy Infrastructure Controller devices do not properly validate SSH keys added to accounts by local users, allowing a local attacker to exploit the...