CWE-1393 Archives - CVE Vulnerability

CVE-2018-15719

Sun, 26 Feb 2023 06:46:46 +0000

Open Dental before version 18.4 installs a mysql database and uses the default credentials of “root” with a blank password. This allows anyone on the network with access to the server to access all database information.

The post CVE-2018-15719 appeared first on CVE Vulnerability.

CVE-2020-11624

Sun, 26 Feb 2023 06:36:18 +0000

An issue was discovered in AvertX Auto focus Night Vision HD Indoor/Outdoor IP Dome Camera HD838 and Night Vision HD Indoor/Outdoor Mini IP Bullet Camera HD438. They do not require users to change the default password for the admin account. They only show a pop-up window suggesting a change but there’s no enforcement. An administrator can click Cancel and proceed to use the device without changing the password. Additionally, they disclose the default username within the login.js script. Since many attacks for IoT devices, including malware and exploits, are based on the usage of default credentials, it makes these cameras an easy target for malicious actors.

The post CVE-2020-11624 appeared first on CVE Vulnerability.

CVE-2021-44480

Thu, 23 Feb 2023 14:12:42 +0000

Wokka Lokka Q50 devices through 2021-11-30 allow remote attackers (who know the SIM phone number and password) to listen to a device’s surroundings via a callback in an SMS command, as demonstrated by the 123456 and 523681 default passwords.

The post CVE-2021-44480 appeared first on CVE Vulnerability.

CVE-2021-38759

Thu, 23 Feb 2023 14:11:19 +0000

Raspberry Pi OS through 5.10 has the raspberry default password for the pi account. If not changed, attackers can gain administrator privileges.

The post CVE-2021-38759 appeared first on CVE Vulnerability.

CVE-2022-30270

godfreyd94 — Thu, 23 Feb 2023 05:18:37 +0000

The Motorola ACE1000 RTU through 2022-05-02 has default credentials. It exposes an SSH interface on port 22/TCP. This interface is used for remote maintenance and for SFTP file-transfer operations that are part of engineering software functionality. Access to this interface is controlled by 5 preconfigured accounts (root, abuilder, acelogin, cappl, ace), all of which come with default credentials. Although the ACE1000 documentation mentions the root, abuilder and acelogin accounts and instructs users to change the default credentials, the cappl and ace accounts remain undocumented and thus are unlikely to have their credentials changed.

The post CVE-2022-30270 appeared first on CVE Vulnerability.

CVE-2022-2336

Thu, 23 Feb 2023 05:03:02 +0000

Softing Secure Integration Server, edgeConnector, and edgeAggregator software ships with the default administrator credentials as `admin` and password as `admin`. This allows Softing to log in to the server directly to perform administrative functions. Upon installation or upon first login, the application does not ask the user to change the `admin` password. There is no warning or prompt to ask the user to change the default password, and to change the password, many steps are required.

The post CVE-2022-2336 appeared first on CVE Vulnerability.