CWE-798 Archives - CVE Vulnerability

CVE-2008-2369

Sun, 26 Feb 2023 09:09:28 +0000

manzier.pxt in Red Hat Network Satellite Server before 5.1.1 has a hard-coded authentication key, which allows remote attackers to connect to the server and obtain sensitive information about user accounts and entitlements.

The post CVE-2008-2369 appeared first on CVE Vulnerability.

CVE-2008-1160

Sun, 26 Feb 2023 09:08:53 +0000

ZyXEL ZyWALL 1050 has a hard-coded password for the Quagga and Zebra processes that is not changed when it is set by a user, which allows remote attackers to gain privileges.

The post CVE-2008-1160 appeared first on CVE Vulnerability.

CVE-2008-0961

Sun, 26 Feb 2023 09:08:47 +0000

EMV DiskXtender 6.20.060 has a hard-coded login and password, which allows remote attackers to bypass authentication via the RPC interface.

The post CVE-2008-0961 appeared first on CVE Vulnerability.

CVE-2007-1063

Sun, 26 Feb 2023 09:05:43 +0000

The SSH server in Cisco Unified IP Phone 7906G, 7911G, 7941G, 7961G, 7970G, and 7971G, with firmware 8.0(4)SR1 and earlier, uses a hard-coded username and password, which allows remote attackers to access the device.

The post CVE-2007-1063 appeared first on CVE Vulnerability.

CVE-2018-9195

Sun, 26 Feb 2023 06:51:46 +0000

Use of a hardcoded cryptographic key in the FortiGuard services communication protocol may allow a Man in the middle with knowledge of the key to eavesdrop on and modify information (URL/SPAM services in FortiOS 5.6, and URL/SPAM/AV services in FortiOS 6.0.; URL rating in FortiClient) sent and received from Fortiguard severs by decrypting these messages. Affected products include FortiClient for Windows 6.0.6 and below, FortiOS 6.0.7 and below, FortiClient for Mac OS 6.2.1 and below.

The post CVE-2018-9195 appeared first on CVE Vulnerability.

CVE-2018-9149

Sun, 26 Feb 2023 06:51:45 +0000

The Zyxel Multy X (AC3000 Tri-Band WiFi System) device doesn’t use a suitable mechanism to protect the UART. After an attacker dismantles the device and uses a USB-to-UART cable to connect the device, he can use the 1234 password for the root account to login to the system. Furthermore, an attacker can start the device’s TELNET service as a backdoor.

The post CVE-2018-9149 appeared first on CVE Vulnerability.

CVE-2018-9161

Sun, 26 Feb 2023 06:51:45 +0000

Prisma Industriale Checkweigher PrismaWEB 1.21 allows remote attackers to discover the hardcoded prisma password for the prismaweb account by reading user/scripts/login_par.js.

The post CVE-2018-9161 appeared first on CVE Vulnerability.

CVE-2018-9112

Sun, 26 Feb 2023 06:51:44 +0000

A low privileged admin account with a weak default password of admin exists on the Foxconn FEMTO AP-FC4064-T AP_GT_B38_5.8.3lb15-W47 LTE Build 15. In addition, its web management page relies on the existence or values of cookies when performing security-critical operations. One can gain privileges by modifying cookies.

The post CVE-2018-9112 appeared first on CVE Vulnerability.

CVE-2018-9068

Sun, 26 Feb 2023 06:51:43 +0000

The IMM2 First Failure Data Capture function collects management module logs and diagnostic information when a hardware error is detected. This information is made available for download through an SFTP server hosted on the IMM2 management network interface. In versions earlier than 4.90 for Lenovo System x and earlier than 6.80 for IBM System x, the credentials to access the SFTP server are hard-coded and described in the IMM2 documentation, allowing an attacker with management network access to obtain the collected FFDC data. After applying the update, the IMM2 will create random SFTP credentials for use with OneCLI.

The post CVE-2018-9068 appeared first on CVE Vulnerability.

CVE-2018-9073

Sun, 26 Feb 2023 06:51:43 +0000

Lenovo Chassis Management Module (CMM) prior to version 2.0.0 utilizes a hardcoded encryption key to protect certain secrets. Possession of the key can allow an attacker that has already compromised the server to decrypt these secrets.

The post CVE-2018-9073 appeared first on CVE Vulnerability.