PT-2020-14349

Name of the Vulnerable Software and Affected Versions Zyxel CloudCNM SecuManager versions 3.1.0 through 3.1.1 Description The issue concerns a hardcoded DSA SSH key for the root account, which could potentially allow unauthorized access. Recommendations For versions 3.1.0 and 3.1.1, consider...

PT-2020-14351

Name of the Vulnerable Software and Affected Versions Zyxel CloudCNM SecuManager versions 3.1.0 through 3.1.1 Description The issue concerns a hardcoded RSA SSH key for the root account, which poses a security risk. Recommendations For versions 3.1.0 and 3.1.1, consider changing the root account...

PT-2020-14356

Name of the Vulnerable Software and Affected Versions Zyxel CloudCNM SecuManager versions 3.1.0 through 3.1.1 Description The issue concerns a hardcoded RSA SSH key for the root account, located within the /opt/mysql chroot directory tree. Recommendations For versions 3.1.0 and 3.1.1, consider...

PT-2020-14354

Name of the Vulnerable Software and Affected Versions Zyxel CloudCNM SecuManager versions 3.1.0 through 3.1.1 Description The issue concerns a hardcoded RSA SSH key for the root account, located within the /opt/axess chroot directory tree. Recommendations For versions 3.1.0 and 3.1.1, consider...

PT-2020-14352

Name of the Vulnerable Software and Affected Versions Zyxel CloudCNM SecuManager versions 3.1.0 through 3.1.1 Description The issue concerns a hardcoded DSA SSH key for the root account, located within the /opt/axess chroot directory tree. Recommendations For versions 3.1.0 and 3.1.1, update the...

PT-2020-14355

Name of the Vulnerable Software and Affected Versions Zyxel CloudCNM SecuManager versions 3.1.0 through 3.1.1 Description The issue concerns a hardcoded DSA SSH key for the root account, located within the /opt/mysql chroot directory tree. Recommendations For versions 3.1.0 and 3.1.1, consider...

PT-2020-14353

Name of the Vulnerable Software and Affected Versions Zyxel CloudCNM SecuManager versions 3.1.0 through 3.1.1 Description The issue concerns a hardcoded ECDSA SSH key for the root account, located within the /opt/axess chroot directory tree. Recommendations For versions 3.1.0 and 3.1.1, consider...

PT-2020-14350

Name of the Vulnerable Software and Affected Versions Zyxel CloudCNM SecuManager versions 3.1.0 through 3.1.1 Description The issue concerns a hardcoded ECDSA SSH key for the root account, which poses a security risk. Recommendations For versions 3.1.0 and 3.1.1, consider changing the SSH key for...

CVE-2020-15318: Use of Hard-coded Credentials

Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a hardcoded DSA SSH key for the root account within the /opt/mysql chroot directory tree...

CVE-2020-15340

Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a hardcoded opt/axess/AXAssets/defaultaxess/axess/TR69/Handlers/turbolink/sshkeys/idrsa SSH key...

CVE-2020-15340

Zyxel CloudCNM SecuManager versions 3.1.0 and 3.1.1 are affected by a hardcoded SSH key located at opt/axess/AXAssets/default_axess/axess/TR69/Handlers/turbolink/sshkeys/id_rsa. The issue arises from embedding credentials used in TR-069 handling, enabling potential unauthorized access if exploite...

CVE-2020-15340: Missing Encryption of Sensitive Data

Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a hardcoded opt/axess/AXAssets/defaultaxess/axess/TR69/Handlers/turbolink/sshkeys/idrsa SSH key...

Cisco Nexus 9000 Series Fabric Switches Application Centric Infrastructure Mode Default SSH Key Vulnerability (cisco-sa-20190501-nexus9k-sshkey)

According to its self-reported version, Cisco NX-OS Software for Nexus 9000 Series Fabric Switches ACI Mode has a Default SSH System Key. An unauthenticated, remote attacker can exploit this, to gain root privileges. Please see the included Cisco BIDs and Cisco Security Advisory for more...

Information Disclosure

kexec-tools is vulnerable to information disclosure. mkdumprd created initrd files with world-readable permissions. A local user could possibly use this flaw to gain access to sensitive information, such as the private SSH key used to authenticate to a remote server when kdump was configured to...

Zyxel CNM SecuManager 3.1.0 / 3.1.1 Hardcoded Keys / XSS / Code Execution Vulnerabilities

Zyxel CNM SecuManager versions 3.1.0 and 3.1.1 suffer from having hard-coded secrets, missing authentication, backdoors, and remote code execution vulnerabilities. Zyxel CNM SecuManager 3.1.0 / 3.1.1 Hardcoded Keys / XSS / Code Execution The HTML version on "Multiple vulnerabilities found in Zyxe...

Zyxel CNM SecuManager 3.1.0 / 3.1.1 Hardcoded Keys / XSS / Code Execution

Hello, Please find a text-only version below sent to security mailing lists. The HTML version on "Multiple vulnerabilities found in Zyxel CNM SecuManager" is posted here: https://pierrekim.github.io/blog/2020-03-09-zyxel-secumanager-0day-vulnerabilities.html === text-version of the advisory ===...

CloudBees Jenkins Mac Plugin Data Falsification Issue Vulnerability

CloudBees Jenkins Hudson Labs is the United States CloudBees company's set of Java-based development of continuous integration tools . The product is mainly used to monitor the continuous software version release/testing project and some timed execution of the task . Mac Plugin is used in one of...

Missing SSH host key validation in mac

mac 1.1.0 and earlier does not use SSH host key validation when connecting to Mac Cloud host launched by the plugin. This lack of validation could be abused using a man-in-the-middle attack to intercept these connections to build agents. mac 1.2.0 validates SSH host keys when connecting to agents...

SSH Key Persistence

This module will add an SSH key to a specified user or all, to allow remote login via SSH at any time. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'sshkey' class MetasploitModule 'SSH Key Persistence',...

Centreon 19.10.5 - centreontrapd Remote Command Execution

Centreon 19.10.5 - centreontrapd Remote Command Execution Exploit Title: Centreon 19.10.5 - 'centreontrapd' Remote Command Execution Date: 2020-01-29 Exploit Author: Fabien AUNAY, Omri Baso Vendor Homepage: https://www.centreon.com/ Software Link: https://github.com/centreon/centreon Version:...