CVE-2020-11965

In IQrouter through 3.3.1, there is a root user without a password, which allows attackers to gain full remote access via SSH. Note: The vendor claims that this vulnerability can only occur on a brand-new network that, after initiating the forced initial configuration which has a required step fo...

CVE-2020-11965

In IQrouter 3.3.1 and earlier, a root password is missing, enabling full remote SSH access. The root account has an empty password during initial setup, allowing an attacker with network access to gain full control. The issue is tied to initial configuration behavior and is stated to also reflect...

IBM Data Risk Manager a3user Default Password

This module abuses a known default password in IBM Data Risk Manager. The 'a3user' has the default password 'idrm' and allows an attacker to log in to the virtual appliance via SSH. This can be escalate to full root access, as 'a3user' has sudo access with the default password. At the time of...

libssh2 < 1.8.1 Integer Overflow Vulnerability.

An integer overflow condition exists in libssh2 before 1.8.1 due to the way packets are read from the server. An authenticated, local attacker can exploit this if they have already compromised an SSH server. The attacker may be able to execute code on the system of users who connect to the SSH...

PT-2020-12956 · Openwrt +1 · Openwrt +1

Name of the Vulnerable Software and Affected Versions: IQrouter versions 3.3.1 and earlier Description: The issue allows attackers to gain full remote access via SSH due to a root user without a password. This can occur on a brand-new network that has not been configured, specifically after...

Fedora: Security Advisory for libssh (FEDORA-2020-5a77f0d68f)

The remote host is missing an update for the Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Poorly Secured Docker Image Comes Under Rapid Attack

In a vivid example of why cloud infrastructure needs strong security, a simple Docker container honeypot was used for four different criminal campaigns in the span of 24 hours, in a recent lab test. Akamai security researcher Larry Cashdollar set up the Docker image to see what kind of notice it...

Huawei EulerOS: Security Advisory for libssh2 (EulerOS-SA-2020-1405)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

GaussDB: Enable PL Audit

If the audit level is set to 8, the parsing and execution of stored procedures are audited, for example, EXECUTE EXEC and CALL. In addition, the definitions of anonymous blocks in stored procedures are audited. SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted fr...

SUSE SLES12 Security Update : git (SUSE-SU-2020:0992-1)

This update for git fixes the following issues : Security issue fixed : CVE-2020-5260: With a crafted URL that contains a newline in it, the credential helper machinery can be fooled to give credential information for a wrong host bsc1168930. Non-security issue fixed : git was updated to 2.26.0 f...

CVE-2019-14326

An issue was discovered in AndyOS Andy versions up to 46.11.113. By default, it starts telnet and ssh ports 22 and 23 with root privileges in the emulated Android system. This can be exploited by remote attackers to gain full access to the device, or by malicious apps installed inside the emulato...

CVE-2019-14326

Summary: CVE-2019-14326 affects AndyOS Andy up to 46.11.113. By default, the emulator starts telnet and ssh (ports 22 and 23) with root privileges inside the emulated Android system. This enables potential remote access to a root shell, and also allows privilege escalation from a normal user to r...

Information Disclosure

kexec-tools is vulnerable to information disclosure. mkdumprd created initrd files with world-readable permissions. A local user could possibly use this flaw to gain access to sensitive information, such as the private SSH key used to authenticate to a remote server when kdump was configured to...

Information Disclosure

kexec-tools is vulnerable to information disclosure. mkdumprd included unneeded sensitive files such as all files from the "/root/.ssh/" directory and the host's private SSH keys in the resulting initrd. This could lead to an information leak when initrd files were previously created with...

Information Disclosure

kexec-tools is vulnerable to information disclosure. Kdump used the SSH Secure Shell "StrictHostKeyChecking=no" option when dumping to SSH targets, causing the target kdump server's SSH host key not to be checked. This could make it easier for a man-in-the-middle attacker on the local network to...

Man-in-the-Middle (MitM)

openssh is vulnerable to man-in-the-middle attack. A flaw was found in the SSH protocol. An attacker able to perform a man-in-the-middle attack may be able to obtain a portion of plain text from an arbitrary ciphertext block when a CBC mode cipher was used to encrypt SSH communication. This updat...

VulnCheck KEV: CVE-2019-19750

minerstat msOS before 2019-10-23 does not have a unique SSH key for each instance of the product...

VulnCheck KEV: CVE-2020-5200

Minerbabe through V4.16 ships with SSH host keys baked into the installation image, which allows man-in-the-middle attacks and makes identification of all public IPv4 nodes trivial with Shodan.io...

CVE-2019-10150

It was found that OpenShift Container Platform does not perform SSH Host Key checking when using ssh key authentication during builds. An attacker, with the ability to redirect network traffic, could use this to alter the resulting build output. Mitigation Use only methods such as HTTPS with TLS...

CVE-2018-16837

The User module in Ansible leaks any data which is passed on as a parameter to ssh-keygen. This could lead to undesirable situations such as passphrase credentials being passed as a parameter for the ssh-keygen executable, showing those credentials in clear text form for every user which have...