Collaborate Disseminate
The Dentsply Sirona(previously known as Shick Technologies)CDR DICOM is software for managing medical dental records. CDR DICOM contains several hard-coded credentials allowing administrative or root access. Continue reading VU#548399: Dentsply Sirona CDR DICOM contains multiple hard-coded credentials
Open Dental is medical dental records management software. Open Dental version 16.1,and previous versions,installs with a blank root database(MySQL)password by default.. An attacker with network access to an Open Dental MySQL database could read,modify,or delete data. This Vulnerability Note initially,and incorrectly,stated that Open Dental used hard coded credentials. The Impact section also implied that in its default configuration,the Open Dental database was available over remote networks such as the internet. An Open Dental database would need to be specifically configured to allow remote network access. Continue reading VU#619767: Open Dental uses blank database password by default
The FortinetFortiWAN(Ascernlink)network load balancer appliance contains multiple vulnerabilities. Continue reading VU#724487: Fortinet FortiWAN load balancer appliance contains multiple vulnerabilities
The Accellion Kiteworks appliance prior to version kw2016.03.00 contains multiple vulnerabilities. Continue reading VU#305607: Accellion Kiteworks contains multiple vulnerabilities
ReadyDesk,version 9.1 and possibly others,contains SQL injection,path traversal,hard-coded cryptographic key,and arbitrary file upload vulnerabilities that may be leveraged to expose sensitive data and execute arbitrary code in the context of the vulnerable software. Continue reading VU#294272: ReadyDesk contains multiple vulnerabilities
HTTP CONNECT requests and 407 Proxy Authentication Required messages are not integrity protected and are susceptible to man-in-the-middle attacks. WebKit-based applications are additionally vulnerable to arbitrary HTML markup and JavaScript execution in the context of the originally requested domain. Continue reading VU#905344: HTTP CONNECT and 407 Proxy Authentication Required messages are not integrity protected
The Zmodo ZP-NE14-S DVR and ZP-IBH-13W cameras contain hard-coded credentials and run telnet by default. Continue reading VU#301735: Zmodo ZP-NE14-S DVR and ZP-IBH-13W cameras contain hard-coded credentials
D-Link DIR routers contain a stack-based buffer overflow vulnerability,which may allow a remote attack to execute arbitrary code. Continue reading VU#332115: D-Link routers contain buffer overflow vulnerability
UltraVNC repeater versions prior to ultravnc_repeater_1300 do not restrict usage by IP address by default and cannot restrict by ports,which may be leveraged to induce connections to arbitrary hosts using any port. Continue reading VU#735416: UltraVNC repeater does not restrict IP addresses or ports by default
Web proxy auto-config(PAC)files are passed the full HTTPS URL in GET requests which may expose sensitive data. Continue reading VU#877625: Proxy auto-config (PAC) files have access to full HTTPS URLs