CVE-2020-15315

CVE-2020-15315 affects ZyXEL CloudCNM SecuManager 3.1.0 and 3.1.1. The connected CNVD entry characterizes a trust-management issue and notes that attackers could exploit weak/default credentials, hard-coded passwords or certificates to compromise components. The CVE description specifies a hard-c...

CVE-2020-15315

Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a hardcoded DSA SSH key for the root account within the /opt/axess chroot directory tree...

CVE-2020-15314

Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a hardcoded RSA SSH key for the root account...

CVE-2020-15314

CVE-2020-15314 affects Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1. The vulnerability is caused by a hardcoded RSA SSH key for the root account, as confirmed by multiple connected sources (Red Hat, CNVD, NVD listings). This login credential issue enables potential unauthorized root access if an at...

CVE-2020-15313

Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a hardcoded ECDSA SSH key for the root account...

CVE-2020-15313

CVE-2020-15313 affects Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1. The connected sources confirm a root‑level issue: a hardcoded ECDSA SSH key stored for the root account, creating a persistent authentication risk. Documented by NVD, Red Hat, CNVD, and CVE records, this is a configuration/credent...

CVE-2020-15312

CVE-2020-15312 affects Zyxel CloudCNM SecuManager versions 3.1.0 and 3.1.1. The root cause is a hardcoded DSA SSH key for the root account, enabling potential unauthorized root access via SSH. Metrics indicate a network exposure with high attack complexity and no user interaction, but with partia...

CVE-2020-15312

Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a hardcoded DSA SSH key for the root account...

FreeBSD : PuTTY -- Release 0.74 fixes two security vulnerabilities (6190c0cd-b945-11ea-9401-2dcf562daa69)

Simon Tatham reports : Release 0.74 fixes the following security issues : - New configuration option to disable PuTTY's default policy of changing its host key algorithm preferences to prefer keys it already knows. There is a theoretical information leak in this policy. CVE-2020-14002 - In some...

PuTTY -- Release 0.74 fixes two security vulnerabilities

Simon Tatham reports: Release 0.74 fixes the following security issues: New configuration option to disable PuTTY's default policy of changing its host key algorithm preferences to prefer keys it already knows. There is a theoretical information leak in this policy. CVE-2020-14002 In some...

CVE-2020-15340

Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a hardcoded opt/axess/AXAssets/defaultaxess/axess/TR69/Handlers/turbolink/sshkeys/idrsa SSH key...

CVE-2020-15340

Zyxel CloudCNM SecuManager versions 3.1.0 and 3.1.1 are affected by a hardcoded SSH key located at opt/axess/AXAssets/default_axess/axess/TR69/Handlers/turbolink/sshkeys/id_rsa. The issue arises from embedding credentials used in TR-069 handling, enabling potential unauthorized access if exploite...

CVE-2004-1653 SSH port forwarding exposes unprotected internal services

An improper access control vulnerability in the admin SSH console of multiple products may allow an authenticated user to access internal only system services via using SSH local port forwarding. A successful attack needs an authenticated admin SSH user to set up a port bounce to product internal...

Docker Images Containing Cryptojacking Malware Distributed via Docker Hub

With Docker gaining popularity as a service to package and deploy software applications, malicious actors are taking advantage of the opportunity to target exposed API endpoints and craft malware-infested images to facilitate distributed denial-of-service DDoS attacks and mine cryptocurrencies...

EulerOS Virtualization for ARM 64 3.0.6.0 : python-paramiko (EulerOS-SA-2020-1703)

According to the version of the python-paramiko package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability : - Paramiko version 2.4.1, 2.3.2, 2.2.3, 2.1.5, 2.0.8, 1.18.5, 1.17.6 contains a Incorrect Access Control...

ENTTEC Lighting Controllers (Update A)

1. EXECUTIVE SUMMARY CVSS v3 8.8 ATTENTION: Exploitable remotely/low skill level to exploit/public exploits are available Vendor: ENTTEC Equipment: Datagate Mk2, Storm 24, Pixelator, E-Streamer Mk2 Vulnerabilities: Use of Hard-coded Cryptographic Key, Cross-site Scripting, Improper Access Control...

Photon OS 2.0: Openssh PHSA-2020-2.0-0253

An update of the openssh package has been released. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2020-2.0-0253. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

Arista Restricted Shell Escape - Privilege Escalation

This Metasploit module takes advantage of a poorly configured TACACS+ config, This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'net/ssh' require 'net/ssh/commandstream' class MetasploitModule 'Arista restricted...

DroidTracker - Script To Generate An Android App To Track Location In Real Time

Script to generate an Android App to track location in real time Features: Custom App Name 2 Port Forwarding options Ngrok or using SSH Tunneling with Serveo.net Obfuscated URL by Tinyurl Fully Undetectable Legal disclaimer: Usage of DroidTracker for attacking targets without prior mutual consent...

About the security content of watchOS 6.2 - Apple Support

About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available. Recent releases are listed on the Apple security updates page. Apple security documents reference...