Quantum DXi V1000静态密钥安全漏洞

Bugtraq ID:66267 Quantum DXi V1000是一款功能完备的虚拟重复数据删除设备。 Quantum DXi V1000存在一个root账户的静态SSH私钥，允许攻击者利用该密钥未授权以root权限访问设备。 该设备的root用户还包含内置密码。 0 Quantum DXi V1000 2.2.1 Quantum DXi V1000 2.3.0.1已经修复该漏洞，建议用户下载更新： http://quantum.com/...

Quantum DXi V1000 2.2.1 - Static SSH Key

Quantum DXi V1000 2.2.1 - Static SSH Key ----------- Author: ----------- xistence ------------------------- Affected products: ------------------------- Quantum DXi V1000 2.2.1 and below ------------------------- Affected vendors: ------------------------- Quantum http://quantum.com/...

Quantum DXi V1000 2.2.1 - Static SSH Key

Quantum DXi® V-Series is a virtual deduplication backup appliance that protects physical and virtual data across remote sites, the datacenter and cloud deployments. Details: ---------- 0x01 - Default root user The root user has a hardcoded password that is unknown and not changeable. Normally...

Loadbalancer.org Enterprise VA 7.5.2 - Static SSH Key

----------- Author: ----------- xistence ------------------------- Affected products: ------------------------- Loadbalancer.org Enterprise VA 7.5.2 and below ------------------------- Affected vendors: ------------------------- Loadbalancer.org http://www.loadbalancer.org/...

Loadbalancer.org Enterprise VA 7.5.2 - Static SSH Key

Loadbalancer.org Enterprise VA 7.5.2 - Static SSH Key ----------- Author: ----------- xistence ------------------------- Affected products: ------------------------- Loadbalancer.org Enterprise VA 7.5.2 and below ------------------------- Affected vendors: ------------------------- Loadbalancer.o...

Quantum DXi Remote 'root' Authentication Bypass Vulnerability

Quantum DXi is prone to an authentication bypass vulnerability. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Loadbalancer.org Enterprise VA 7.5.2 - Static SSH Key Vulnerability

The Loadbalancer.org Virtual Appliance is a revolution in software load balancing. The software is simple to install on Windows, Mac & Linux and does not have any adverse effects on the host operating system. Details: ---------- 0x01 - SSH Private Key Loadbalancer.org Enterprise VA 7.5.2 contains...

Loadbalancer.org Enterprise VA 7.5.2 Static SSH Key

Loadbalancer.org Enterprise VA 7.5.2 contains a default SSH private key. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Array Networks vAPV and vxAG Private Key Privilege Escalation Code Execution

This module exploits a default hardcoded private SSH key or default hardcoded login and password in the vAPV 8.3.2.17 and vxAG 9.2.0.34 appliances made by Array Networks. After logged in as the unprivileged user, it's possible to modify the world-writable file /ca/bin/monitor.sh with...

Loadbalancer.org Enterprise VA 7.5.2 Static SSH Key

----------- Author: ----------- xistence ------------------------- Affected products: ------------------------- Loadbalancer.org Enterprise VA 7.5.2 and below ------------------------- Affected vendors: ------------------------- Loadbalancer.org http://www.loadbalancer.org/...

Quantum DXi V1000 2.2.1 SSH Key / Root User

----------- Author: ----------- xistence ------------------------- Affected products: ------------------------- Quantum DXi V1000 2.2.1 and below ------------------------- Affected vendors: ------------------------- Quantum http://quantum.com/ ------------------------- Product description:...

Code injection

The Red Hat mkdumprd script for kexec-tools, as distributed in the kexec-tools 1.x before 1.102pre-154 and 2.x before 2.0.0-209 packages in Red Hat Enterprise Linux, uses world-readable permissions for vmcore files, which allows local users to obtain sensitive information by inspecting the file...

Code injection

The SSH configuration in the Red Hat mkdumprd script for kexec-tools, as distributed in the kexec-tools 1.x before 1.102pre-154 and 2.x before 2.0.0-209 packages in Red Hat Enterprise Linux, disables the StrictHostKeyChecking option, which allows man-in-the-middle attackers to spoof kdump servers...

CVE-2011-3589

The Red Hat mkdumprd script for kexec-tools, as distributed in the kexec-tools 1.x before 1.102pre-154 and 2.x before 2.0.0-209 packages in Red Hat Enterprise Linux, uses world-readable permissions for vmcore files, which allows local users to obtain sensitive information by inspecting the file...

CVE-2013-6838

CVE-2013-6838 affects Enghouse Interactive IVR Pro (VIP2000) 9.0.3 (rel903) when using OpenVZ with fallback customization. The vulnerability stems from using the same SSH private key across different customer installations, enabling remote attackers to gain privileges; advisories (XPD-2013-001) d...

PineApp MailSecure - Remote Command Execution Vulnerability

Exploit for linux platform in category remote exploits ----------------------------------------------------------------- It is possible execute any command bash as qmailq unprivilege user, sending only the following https request, without authentication...

PineApp MailSecure - Remote Command Execution

PineApp MailSecure - Remote Command Execution ----------------------------------------------------------------- It is possible execute any command bash as qmailq unprivilege user, sending only the following https request, without authentication...

PineApp MailSecure - Remote Command Execution

----------------------------------------------------------------- It is possible execute any command bash as qmailq unprivilege user, sending only the following https request, without authentication...

Super Micro IPMI zero-day vulnerabilities disclosed

Metasploit creator and Rapid7 CSO HD Moore today disclosed seven zero-day vulnerabilities in IPMI firmware from vendor Super Micro. The security issues were reported to the vendor in August, however the vendor, beyond acknowledging receipt of the vulnerabilities never communicated with Rapid7...

CVE-2012-4109

The clear sshkey command in the fabric-interconnect component in Cisco Unified Computing System UCS allows local users to gain privileges by embedding commands in an unspecified parameter, aka Bug ID CSCtq86559...