CWE-521 Archives - CVE Vulnerability

CVE-2018-6312

Sun, 26 Feb 2023 06:50:40 +0000

A privileged account with a weak default password on the Foxconn femtocell FEMTO AP-FC4064-T version AP_GT_B38_5.8.3lb15-W47 LTE Build 15 can be used to turn on the TELNET service via the web interface, which allows root login without any password. This vulnerability will lead to full system compromise and disclosure of user communications. The foxconn account with an 8-character lowercase alphabetic password can be used.

The post CVE-2018-6312 appeared first on CVE Vulnerability.

CVE-2018-5389

Sun, 26 Feb 2023 06:50:19 +0000

The Internet Key Exchange v1 main mode is vulnerable to offline dictionary or brute force attacks. Reusing a key pair across different versions and modes of IKE could lead to cross-protocol authentication bypasses. It is well known, that the aggressive mode of IKEv1 PSK is vulnerable to offline dictionary or brute force attacks. For the main mode, however, only an online attack against PSK authentication was thought to be feasible. This vulnerability could allow an attacker to recover a weak Pre-Shared Key or enable the impersonation of a victim host or network.

The post CVE-2018-5389 appeared first on CVE Vulnerability.

CVE-2018-1956

Sun, 26 Feb 2023 06:48:12 +0000

IBM Security Identity Manager 6.0.0 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. IBM X-Force ID: 153628.

The post CVE-2018-1956 appeared first on CVE Vulnerability.

CVE-2018-19064

Sun, 26 Feb 2023 06:48:01 +0000

An issue was discovered on Foscam C2 devices with System Firmware 1.11.1.8 and Application Firmware 2.72.1.32, and Opticam i5 devices with System Firmware 1.5.2.11 and Application Firmware 2.21.1.128. The ftpuser1 account has a blank password, which cannot be changed.

The post CVE-2018-19064 appeared first on CVE Vulnerability.

CVE-2018-18562

Sun, 26 Feb 2023 06:47:50 +0000

An issue was discovered in Roche Accu-Chek Inform II Base Unit / Base Unit Hub before 03.01.04 and CoaguChek / cobas h232 Handheld Base Unit before 03.01.04. Weak access credentials may enable attackers in the adjacent network to gain unauthorized service access via a service interface.

The post CVE-2018-18562 appeared first on CVE Vulnerability.

CVE-2018-1680

Sun, 26 Feb 2023 06:47:12 +0000

IBM Security Privileged Identity Manager Virtual Appliance 2.2.1 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. IBM X-Force ID: 145236.

The post CVE-2018-1680 appeared first on CVE Vulnerability.

CVE-2018-16703

Sun, 26 Feb 2023 06:47:09 +0000

A vulnerability in the Gleez CMS 1.2.0 login page could allow an unauthenticated, remote attacker to perform multiple user enumerations, which can further help an attacker to perform login attempts in excess of the configured login attempt limit. The vulnerability is due to insufficient server-side access control and login attempt limit enforcement. An attacker could exploit this vulnerability by sending modified login attempts to the Portal login page. An exploit could allow the attacker to identify existing users and perform brute-force password attacks on the Portal, as demonstrated by navigating to the user/4 URI.

The post CVE-2018-16703 appeared first on CVE Vulnerability.

CVE-2018-15766

Sun, 26 Feb 2023 06:46:47 +0000

On install, Dell Encryption versions prior 10.0.1 and Dell Endpoint Security Suite Enterprise versions prior 2.0.1 will overwrite and manually set the “Minimum Password Length” group policy object to a value of 1 on that device. This allows for users to bypass any existing policy for password length and potentially create insecure password on their device. This value is defined during the installation of the “Encryption Management Agent” or “EMAgent” application. There are no other known values modified.

The post CVE-2018-15766 appeared first on CVE Vulnerability.

CVE-2018-15748

Sun, 26 Feb 2023 06:46:46 +0000

On Dell 2335dn printers with Printer Firmware Version 2.70.05.02, Engine Firmware Version 1.10.65, and Network Firmware Version V4.02.15(2335dn MFP) 11-22-2010, the admin interface allows an authenticated attacker to retrieve the configured SMTP or LDAP password by viewing the HTML source code of the Email Settings webpage. In some cases, authentication can be achieved with the blank default password for the admin account. NOTE: the vendor indicates that this is an “End Of Support Life” product.

The post CVE-2018-15748 appeared first on CVE Vulnerability.

CVE-2018-1372

Sun, 26 Feb 2023 06:46:06 +0000

IBM Security Guardium Big Data Intelligence (SonarG) 3.1 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. IBM X-Force ID: 137772.

The post CVE-2018-1372 appeared first on CVE Vulnerability.