Man-in-the-Middle (MitM)

ansible is vulnerable to man-in-the-middle attacks. The vulnerability exists because the Git module encourages the use of StrictHostKeyChecking=no with SSH, enabling attackers to intercept the traffic...

Micro Focus Operations Bridge Reporter shrboadmin default password

This module abuses a known default password on Micro Focus Operations Bridge Reporter. The 'shrboadmin' user, installed by default by the product has the password of 'shrboadmin', and allows an attacker to login to the server via SSH. This module has been tested with Micro Focus Operations Bridge...

CVE-2020-21995

Inim Electronics Smartliving SmartLAN/G/SI =6.x uses default hardcoded credentials. An attacker could exploit this to gain Telnet, SSH and FTP access to the system...

Hardcoded credentials

Inim Electronics Smartliving SmartLAN/G/SI =6.x uses default hardcoded credentials. An attacker could exploit this to gain Telnet, SSH and FTP access to the system...

CVE-2020-21995

CVE-2020-21995 affects INIM Electronics SmartLiving SmartLAN/G/SI devices (affected <= 6.x). Root cause is hard-coded credentials embedded in the Linux distribution image, enabling an attacker to access Telnet, SSH, and FTP. Affected models include SmartLiving 505, 515, 1050/1050/G3, 10100L/10...

Authentication Bypass

salt is vulnerable to authentication bypass. The salt-netapi improperly validates eauth credentials and tokens, allowing an attacker to bypass authentication and invoke Salt SSH...

Uber: pam_ussh does not properly validate the SSH certificate authority

The pamussh module that Uber open-sourced in https://github.com/uber/pam-ussh does not validate that the SSH certificate presented by a user is actually signed by a trusted CA listed in the configured cafile...

SUSE: Security Advisory (SUSE-SU-2021:1251-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

OverRide - Binary Exploitation And Reverse-Engineering (From Assembly Into C)

Explore disassembly, binary exploitation & reverse-engineering through 10 little challenges. In the folder for each level you will find: flag - password for next level README.md - how to find password source.c - the reverse engineered binary dissasemblynotes.md - notes on asm See the subject...

Moderate: Red Hat Security Advisory: Ansible security update (2.9.20)

An update for ansible is now available for Ansible Engine 2.9 Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE lin...

Moderate: Red Hat Security Advisory: Ansible security update (2.9.20)

An update for ansible is now available for Ansible Engine 2 Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links...

Exploit for Path Traversal in Vmware Cloud_Foundation

vsphereyeeter.sh is an automated bash script to exploit vuln...

RHEL 7 / 8 : Ansible security update (2.9.20) (Moderate) (RHSA-2021:1342)

The remote Redhat Enterprise Linux 7 / 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2021:1342 advisory. Ansible is a simple model-driven configuration management, multi-node deployment, and remote-task execution system. Ansible works over SSH and do...

Huawei Data Communication: A proper timeout interval must be configured for the VTY

Configure the SSH/telnet login session of the VTY to not time out. Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free...

Huawei Data Communication: Configuring Secure User Authentication Modes and Permission Levels

Configure user rights in the user-interface VTY view. In password authentication mode, this permission is the actual login permission. In AAA authentication mode, this parameter takes effect if no user rights are configured on the AAA server. Configuring password authentication on the VTY is...

Huawei Data Communication: VTY allows Telnet login, which is risky

VTY allows Telnet login, which is risky Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribute ...

Security Bulletin: Resilient - Permitting use of outdated ciphers for SSH (CVE-2016-6063)

Summary Security Bulletin: Resilient - Permitting use of outdated ciphers for SSH CVE-2016-6063 Vulnerability Details Title Security Bulletin: Resilient - Permitting use of outdated ciphers for SSH CVE-2016-6063 Summary The default Debian Linux configuration of SSH includes outdated ciphers that...

CVE-2021-20989

Fibaro Home Center 2 and Lite devices with firmware version 4.600 and older initiate SSH connections to the Fibaro cloud to provide remote access and remote support capabilities. This connection can be intercepted using DNS spoofing attack and a device initiated remote port-forward channel can be...

CVE-2021-20989

Fibaro Home Center 2 and Lite devices with firmware version 4.600 and older initiate SSH connections to the Fibaro cloud to provide remote access and remote support capabilities. This connection can be intercepted using DNS spoofing attack and a device initiated remote port-forward channel can be...

Authorization

Fibaro Home Center 2 and Lite devices with firmware version 4.600 and older initiate SSH connections to the Fibaro cloud to provide remote access and remote support capabilities. This connection can be intercepted using DNS spoofing attack and a device initiated remote port-forward channel can be...