API tools faq
paste
int0x76

2015_RD4000-4300_public - 2015.tsv

int0x76
Sep 13th, 2015
793
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 58.56 KB | None | 0 0
raw download clone embed print report
  1. RD# When (M) Where Reason Access Data leak Findings Comments What
  2. 4000 01 The Netherlands, Rijswijk Vulnerable service: default setting(s) / default credentials Access to CMS / CRM Data leak: > 100 customer/member records default password Topdesk portal
  3. 4001 01 Russia, Moscow Vulnerable service: mis-configured Full access to production data Data leak: Access to confidential data missing encryption of sensitive data Open FTP (anon) – CRUD
  4. 4002 01 Russia, Moscow Vulnerable service: mis-configured Full access to production data Data leak: Access to confidential data missing encryption of sensitive data Open FTP (anon) – CRUD
  5. 4003 01 Russia, Moscow Vulnerable service: mis-configured Full access to production data Data leak: Access to confidential data missing encryption of sensitive data Open FTP (anon) – CRUD
  6. 4004 03 US, California Vulnerable service: mis-configured Full access to production data Data leak: Access to confidential data missing encryption of sensitive data Open FTP (anon) – CRUD Full office breach: daily backup, emails, contracts, financial data, credentials via Seagate NAS
  7. 4005 03 US, New York Information disclosure: DNS zone transfer (internal/external entries) DNS zone transfer 12,637 (internal/external) DNS records
  8. 4006 03 Russia, Moscow Vulnerable service: default setting(s) / default credentials Full access to production data Information disclosure: Sensitive files Bad design: Weak password storage: one-Way Hash without salt Open MongoDB credentials leak
  9. 4007 03 Russia, Moscow Vulnerable service: default setting(s) / default credentials Full access to production data Information disclosure: Sensitive files Bad design: Weak password storage: one-Way Hash without salt Open MongoDB credentials leak
  10. 4008 03 Russia, Moscow Vulnerable service: default setting(s) / default credentials Full access to production data Information disclosure: Sensitive files Bad design: Weak password storage: one-Way Hash without salt Open MongoDB credentials leak
  11. 4009 03 Russia, Moscow Vulnerable service: default setting(s) / default credentials Full access to production data Information disclosure: Sensitive files Bad design: Weak password storage: one-Way Hash without salt Open MongoDB credentials leak
  12. 4010 03 Russia, Moscow Vulnerable service: default setting(s) / default credentials Full access to production data Information disclosure: Sensitive files Bad design: Weak password storage: one-Way Hash without salt Open MongoDB credentials leak
  13. 4011 07 Haiti Vulnerable service: default setting(s) / default credentials Full access to production data Data leak: > 1,000 customer/member records missing encryption of sensitive data Open MongoDB 8510 member records, active sessions and payments
  14. 4012 07 Russia, Moscow Vulnerable service: default setting(s) / default credentials Full access to production data Information disclosure: Sensitive files Bad design: Weak password storage: one-Way Hash without salt Open MongoDB credentials leak
  15. 4013 07 The Netherlands, Rotterdam Vulnerable service: default setting(s) / default credentials Full access to production data Open MongoDB Access to CMS
  16. 4014 07 Germany, Düsseldorf SQL Injection Full access to production data Data leak: > 1,000 customer/member records Bad design: Weak password storage: one-Way Hash without salt SQL Injection Possible to execute SQLi after making an account with mailinator.com
  17. 4015 07 Germany, Jeina SQL Injection Full access to production data Data leak: > 1,000 customer/member records Bad design: Weak password storage: one-Way Hash without salt SQL Injection Possible to execute SQLi after making an account with mailinator.com
  18. 4016 07 Germany, Leipzig Vulnerable service: default setting(s) / default credentials Full access to production data Data leak: > 1,000 customer/member records Bad design: Weak password storage: one-Way Hash without salt Open MongoDB Full access to CMS
  19. 4017 07 Germany, Munich Vulnerable service: default setting(s) / default credentials Poor implementation: No privacy Hikvision security camera Camera over watching a security booth at --classified--- university
  20. 4018 07 Germany, Freiburg Vulnerable service: default setting(s) / default credentials Full access to production data Data leak: > 1,000 customer/member records missing encryption of sensitive data Open MongoDB Full access to ProjectPlace
  21. 4019 07 Germany, Rostock Vulnerable service: not patched with known vulnerabilities CVE-2015-1635 Vulnerable for MS15_034 #HTTPSys Vulnerable for MS15_034 #HTTPSys
  22. 4020 07 Germany, Greifswald Vulnerable service: not patched with known vulnerabilities CVE-2015-1635 Vulnerable for MS15_034 #HTTPSys Vulnerable for MS15_034 #HTTPSys
  23. 4021 07 Germany, Greifswald Vulnerable service: not patched with known vulnerabilities CVE-2015-1635 Vulnerable for MS15_034 #HTTPSys Vulnerable for MS15_034 #HTTPSys
  24. 4022 07 Germany, Greifswald Vulnerable service: not patched with known vulnerabilities CVE-2015-1635 Vulnerable for MS15_034 #HTTPSys Vulnerable for MS15_034 #HTTPSys
  25. 4023 07 Germany, Halle Vulnerable service: not patched with known vulnerabilities CVE-2015-1635 Vulnerable for MS15_034 #HTTPSys Vulnerable for MS15_034 #HTTPSys
  26. 4024 07 Germany, Berlin Information disclosure: Open webdirectory Full access to production data Open Webdir /backup/ with Mysql dumps access to customer data. Mysql dump present
  27. 4025 07 Germany, Bremen Vulnerable service: not patched with known vulnerabilities CVE-2015-1635 Vulnerable for MS15_034 #HTTPSys Vulnerable for MS15_034 #HTTPSys
  28. 4026 07 Germany, Leipzig Vulnerable service: not patched with known vulnerabilities CVE-2015-1635 Vulnerable for MS15_034 #HTTPSys Vulnerable for MS15_034 #HTTPSys
  29. 4027 07 Germany, Leipzig Vulnerable service: not patched with known vulnerabilities CVE-2015-1635 Vulnerable for MS15_034 #HTTPSys Vulnerable for MS15_034 #HTTPSys
  30. 4028 07 Germany, Leipzig Vulnerable service: not patched with known vulnerabilities CVE-2015-1635 Vulnerable for MS15_034 #HTTPSys Vulnerable for MS15_034 #HTTPSys
  31. 4029 07 Germany, Leipzig Vulnerable service: not patched with known vulnerabilities CVE-2015-1635 Vulnerable for MS15_034 #HTTPSys Vulnerable for MS15_034 #HTTPSys
  32. 4030 07 Germany, Leipzig Vulnerable service: not patched with known vulnerabilities CVE-2015-1635 Vulnerable for MS15_034 #HTTPSys Vulnerable for MS15_034 #HTTPSys
  33. 4031 07 Germany, Hamburg Vulnerable service: not patched with known vulnerabilities CVE-2015-1635 Vulnerable for MS15_034 #HTTPSys Vulnerable for MS15_034 #HTTPSys
  34. 4032 07 Germany, Stuttgart Vulnerable service: not patched with known vulnerabilities CVE-2015-1635 Vulnerable for MS15_034 #HTTPSys Vulnerable for MS15_034 #HTTPSys
  35. 4033 07 Germany, Hamburg Vulnerable service: not patched with known vulnerabilities CVE-2015-1635 Vulnerable for MS15_034 #HTTPSys Vulnerable for MS15_034 #HTTPSys
  36. 4034 07 Germany, Hamburg Information disclosure: Open webdirectory Open Webdir /webstats/ Information disclosure: visitors and admin home IP
  37. 4035 07 Germany, Hamburg Vulnerable service: not patched with known vulnerabilities CVE-2015-1635 Vulnerable for MS15_034 #HTTPSys Vulnerable for MS15_034 #HTTPSys
  38. 4036 07 Germany, Hamburg Vulnerable service: not patched with known vulnerabilities CVE-2015-1635 Vulnerable for MS15_034 #HTTPSys Vulnerable for MS15_034 #HTTPSys
  39. 4037 07 Germany, Hamburg Vulnerable service: not patched with known vulnerabilities CVE-2015-1635 Vulnerable for MS15_034 #HTTPSys Vulnerable for MS15_034 #HTTPSys
  40. 4038 07 Germany, Stuttgart Vulnerable service: default setting(s) / default credentials Full access to production data Data leak: > 1,000 customer/member records Open MongoDB
  41. 4039 07 Germany, Stuttgart Vulnerable service: default setting(s) / default credentials Full access to production data Data leak: > 1,000 customer/member records Open MongoDB
  42. 4040 07 Germany, Stuttgart Vulnerable service: default setting(s) / default credentials Full access to production data Data leak: > 1,000 customer/member records Open MongoDB
  43. 4041 07 Germany, Dusseldorf Vulnerable service: not patched with known vulnerabilities CVE-2015-1635 Vulnerable for MS15_034 #HTTPSys Vulnerable for MS15_034 #HTTPSys
  44. 4042 07 Germany, Dusseldorf Vulnerable service: not patched with known vulnerabilities CVE-2015-1635 Vulnerable for MS15_034 #HTTPSys Vulnerable for MS15_034 #HTTPSys
  45. 4043 07 Germany, Dusseldorf Vulnerable service: not patched with known vulnerabilities CVE-2015-1635 Vulnerable for MS15_034 #HTTPSys Vulnerable for MS15_034 #HTTPSys
  46. 4044 07 Germany, Dusseldorf Vulnerable service: not patched with known vulnerabilities CVE-2015-1635 Vulnerable for MS15_034 #HTTPSys Vulnerable for MS15_034 #HTTPSys
  47. 4045 07 Germany, Hamburg Vulnerable CMS Full access to production data Data leak: > 100 customer/member records SQL Injection WordPress SEO by Yoast plugin 1.7.2 is vulnerable
  48. 4046 07 Germany, Hamburg Vulnerable CMS Full access to production data Data leak: > 100 customer/member records SQL Injection WordPress SEO by Yoast plugin 1.7.2 is vulnerable
  49. 4047 07 Germany, Stuttgart Vulnerable service: not patched with known vulnerabilities CVE-2015-1635 Vulnerable for MS15_034 #HTTPSys Vulnerable for MS15_034 #HTTPSys
  50. 4048 07 Germany, Stuttgart Vulnerable service: not patched with known vulnerabilities CVE-2015-1635 Vulnerable for MS15_034 #HTTPSys Vulnerable for MS15_034 #HTTPSys
  51. 4049 07 Germany, Hamburg Vulnerable service: not patched with known vulnerabilities CVE-2015-1635 Vulnerable for MS15_034 #HTTPSys Vulnerable for MS15_034 #HTTPSys
  52. 4050 07 Germany, Hamburg Vulnerable service: not patched with known vulnerabilities CVE-2015-1635 Vulnerable for MS15_034 #HTTPSys Vulnerable for MS15_034 #HTTPSys
  53. 4051 07 Germany, Hamburg Vulnerable service: not patched with known vulnerabilities CVE-2015-1635 Vulnerable for MS15_034 #HTTPSys Vulnerable for MS15_034 #HTTPSys
  54. 4052 07 Germany, Dortmund Vulnerable service: default setting(s) / default credentials Full access to production data Data leak: > 1,000 customer/member records Open MongoDB
  55. 4053 07 Germany, Dortmund Vulnerable service: default setting(s) / default credentials Full access to production data Data leak: > 1,000 customer/member records Open MongoDB
  56. 4054 07 Germany, Stuttgart Vulnerable service: default setting(s) / default credentials Full access to production data Data leak: > 1,000 customer/member records Open MongoDB
  57. 4055 07 Germany, Stuttgart Vulnerable service: default setting(s) / default credentials Full access to production data Data leak: > 1,000 customer/member records Open MongoDB
  58. 4056 07 Germany, Bonn Vulnerable service: mis-configured Full access to staging data Open FTP (anon) – CRUD
  59. 4057 07 Germany, Hamburg Vulnerable service: default setting(s) / default credentials Full access to production data Data leak: > 1,000 customer/member records Open MongoDB
  60. 4058 07 Germany, Hamburg Vulnerable service: default setting(s) / default credentials Full access to production data Data leak: > 1,000 customer/member records Open MongoDB
  61. 4059 07 Germany, Hamburg Vulnerable service: default setting(s) / default credentials Full access to production data Data leak: > 1,000 customer/member records Open MongoDB
  62. 4060 07 Germany, Bonn Vulnerable service: default setting(s) / default credentials Poor implementation: No privacy Data leak: Access to credentials Hikvision security camera Video steam of a RSA token in Interoute DC
  63. 4061 07 Germany, Stuttgart Vulnerable service: default setting(s) / default credentials Full access to production data Data leak: > 1,000 customer/member records Open MongoDB
  64. 4062 07 Germany, Stuttgart Vulnerable service: default setting(s) / default credentials Full access to production data Data leak: > 1,000 customer/member records Open MongoDB
  65. 4063 07 The Netherlands, Amsterdam Vulnerable service: default setting(s) / default credentials Full access to development environment Open MongoDB Full access to CRM (legacy since 2013)
  66. 4064 07 Germany, Stuttgart Vulnerable service: default setting(s) / default credentials Full access to production data Data leak: > 100 customer/member records Open MongoDB
  67. 4065 07 Germany, Stuttgart Vulnerable CMS Full access to production data Data leak: > 100 customer/member records SQL Injection WordPress SEO by Yoast plugin 1.7.2 is vulnerable
  68. 4066 07 Germany, Hamburg Vulnerable CMS Full access to test environment Data leak: > 100 customer/member records SQL Injection WordPress SEO by Yoast plugin 1.7.2 is vulnerable
  69. 4067 07 Germany, Hamburg Vulnerable service: default setting(s) / default credentials Full access to production data Data leak: > 1,000 customer/member records Open MongoDB
  70. 4068 07 Germany, Wuppertal Vulnerable service: default setting(s) / default credentials Full access to production data Data leak: > 100 customer/member records Open MongoDB
  71. 4069 07 Germany, Dortmund Vulnerable service: default setting(s) / default credentials Full access to production data Data leak: > 1,000 customer/member records Open MongoDB
  72. 4070 07 Germany, Hamburg Vulnerable service: default setting(s) / default credentials Full access to production data Data leak: > 100 customer/member records Open MongoDB
  73. 4071 07 Germany, Hamburg Vulnerable service: default setting(s) / default credentials Full access to production data Data leak: > 100 customer/member records Open MongoDB
  74. 4072 07 Germany, Hamburg Vulnerable service: default setting(s) / default credentials Full access to production data Data leak: > 1,000 customer/member records Open MongoDB
  75. 4073 07 Germany, Stuttgart Vulnerable service: default setting(s) / default credentials Full access to production data Data leak: > 1,000 customer/member records Open MongoDB
  76. 4074 07 Russia, Perm Vulnerable service: default setting(s) / default credentials Full access to production data Data leak: > 1,000 customer/member records Open MongoDB Full access to webste cms
  77. 4075 07 India, New Delhi Vulnerable service: default setting(s) / default credentials Full access to production data Data leak: > 100 customer/member records Open MongoDB Full access to webste cms and APP backend
  78. 4076 07 The Netherlands, Amsterdam Vulnerable service: default setting(s) / default credentials Full access to production data Data leak: > 100 customer/member records Open MongoDB Full access to webste cms
  79. 4077 07 Germany, Hamburg Vulnerable service: default setting(s) / default credentials Full access to production data Data leak: > 100 customer/member records Open MongoDB
  80. 4078 07 Germany, Hamburg Vulnerable service: default setting(s) / default credentials Full access to production data Data leak: > 1,000 customer/member records Open MongoDB
  81. 4079 07 Germany, Leverkussen Vulnerable service: default setting(s) / default credentials Full access to production data Data leak: > 100 customer/member records Open MongoDB
  82. 4080 07 Germany, Stuttgart Vulnerable service: default setting(s) / default credentials Full access to production data Data leak: > 100 customer/member records Open MongoDB
  83. 4081 07 US, New York Vulnerable service: default setting(s) / default credentials Full access to production data Data leak: > 1,000 customer/member records Open MongoDB Full access to (obsolete) production data
  84. 4082 07 Germany, Leverkussen Vulnerable service: default setting(s) / default credentials Full access to production data Data leak: > 1,000 customer/member records Open MongoDB
  85. 4083 07 Germany, Stuttgart Vulnerable CMS Full access to test environment Data leak: Access to credentials SQL Injection WordPress SEO by Yoast plugin 1.7.2 is vulnerable
  86. 4084 07 Germany, Stuttgart Vulnerable service: default setting(s) / default credentials Full access to production data Data leak: > 100 customer/member records Open MongoDB
  87. 4085 07 Germany, Koblenz Vulnerable service: default setting(s) / default credentials Full access to production data Data leak: > 100 customer/member records Open MongoDB
  88. 4086 07 Germany, Koblenz Vulnerable service: default setting(s) / default credentials Full access to production data Data leak: > 100 customer/member records Open MongoDB
  89. 4087 07 Germany, Koblenz Vulnerable service: default setting(s) / default credentials Full access to production data Data leak: > 100 customer/member records Open MongoDB
  90. 4088 07 Germany, Dresden Vulnerable service: default setting(s) / default credentials Full access to production data Data leak: > 100 customer/member records Open MongoDB
  91. 4089 07 Germany, Stuttgart Vulnerable service: default setting(s) / default credentials Full access to production data Data leak: > 100 customer/member records Open MongoDB
  92. 4090 07 Germany, Stuttgart Vulnerable service: default setting(s) / default credentials Full access to production data Data leak: > 100 customer/member records Open MongoDB
  93. 4091 07 Germany, Dresden Vulnerable service: default setting(s) / default credentials Full access to production data Data leak: > 1,000 customer/member records Open MongoDB
  94. 4092 07 Germany, Hanover Vulnerable service: default setting(s) / default credentials Full access to production data Data leak: > 100 customer/member records Open MongoDB
  95. 4093 07 Germany, Hanover Vulnerable service: default setting(s) / default credentials Full access to production data Data leak: > 100 customer/member records Open MongoDB
  96. 4094 07 Germany, Hanover Vulnerable service: default setting(s) / default credentials Full access to production data Data leak: > 100 customer/member records Open MongoDB
  97. 4095 07 Germany, Hanover Vulnerable service: default setting(s) / default credentials Full access to production data Data leak: > 1,000 customer/member records Open MongoDB
  98. 4096 07 Germany, Hanover Vulnerable service: default setting(s) / default credentials Full access to production data Data leak: > 100 customer/member records Open MongoDB
  99. 4097 07 Germany, Hanover Vulnerable service: default setting(s) / default credentials Full access to production data Data leak: > 100 customer/member records Open MongoDB
  100. 4098 07 The Netherlands, Groningen Vulnerable service: default setting(s) / default credentials Full access to test environment Data leak: Access to credentials Open MongoDB Full access to development server
  101. 4099 07 Germany, Stuttgart Vulnerable service: default setting(s) / default credentials Full access to production data Data leak: > 100 customer/member records Open MongoDB
  102. 4100 07 The Netherlands, Amsterdam Vulnerable service: default setting(s) / default credentials Full access to production data Data leak: > 10,000 customer/member records Open MongoDB Full access to a small staging server
  103. 4101 07 Germany, Hanover Vulnerable service: default setting(s) / default credentials Full access to production data Data leak: > 100 customer/member records Open MongoDB
  104. 4102 07 Germany, Hanover Vulnerable service: default setting(s) / default credentials Full access to production data Data leak: > 100 customer/member records Open MongoDB
  105. 4103 07 Germany, Dortmund Vulnerable service: default setting(s) / default credentials Full access to production data Data leak: > 100 customer/member records Open MongoDB
  106. 4104 07 Germany, Dresden Vulnerable service: default setting(s) / default credentials Full access to production data Data leak: > 100 customer/member records Open MongoDB
  107. 4105 07 Germany, Dresden Vulnerable service: default setting(s) / default credentials Full access to production data Data leak: > 100 customer/member records Open MongoDB
  108. 4106 07 Germany, Stuttgart Vulnerable service: default setting(s) / default credentials Full access to production data Data leak: > 100 customer/member records Open MongoDB
  109. 4107 07 Germany, Stuttgart Vulnerable service: default setting(s) / default credentials Full access to production data Data leak: > 1,000 customer/member records Open MongoDB
  110. 4108 07 Germany, Dresden Vulnerable service: default setting(s) / default credentials Full access to production data Data leak: > 1,000 customer/member records Open MongoDB
  111. 4109 07 Germany, Dresden Vulnerable service: default setting(s) / default credentials Full access to production data Data leak: > 1,000 customer/member records Open MongoDB
  112. 4110 07 Germany, Dresden Vulnerable service: default setting(s) / default credentials Full access to production data Data leak: > 100 customer/member records Open MongoDB
  113. 4111 07 Germany, Dresden Vulnerable service: default setting(s) / default credentials Full access to production data Data leak: > 100 customer/member records Open MongoDB
  114. 4112 07 Germany, Dresden Vulnerable service: default setting(s) / default credentials Full access to production data Data leak: > 100 customer/member records Open MongoDB
  115. 4113 07 Bolivia, Santa Cruz Vulnerable service: default setting(s) / default credentials Poor implementation: No privacy Hikvision security camera Video footage: Office
  116. 4114 07 Bolivia, Cochabamba Vulnerable service: not patched with known vulnerabilities Command Injection (remote) ProFTPD 1.3.5 CVE-2015-3306
  117. 4115 07 Bolivia, Santa Cruz Vulnerable service: not patched with known vulnerabilities Command Injection (remote) ProFTPD 1.3.5 CVE-2015-3306
  118. 4116 07 Bolivia, La Paz Vulnerable service: not patched with known vulnerabilities Command Injection (remote) ProFTPD 1.3.5 CVE-2015-3306
  119. 4117 07 Spain, Barcelona Vulnerable service: default setting(s) / default credentials Full access to production data Data leak: > 10,000 customer/member records Open MongoDB Full access to customer data
  120. 4118 07 The Netherlands, Zwolle Vulnerable service: default setting(s) / default credentials Full access to production data Data leak: Access to credentials Open MongoDB Full access to production data
  121. 4119 07 The Netherlands, Amsterdam Vulnerable CMS Full access to production data Data leak: > 100 customer/member records SQL Injection WordPress SEO by Yoast plugin 1.7.2 is vulnerable
  122. 4120 07 Sweden, Stockholm Vulnerable CMS Full access to production data Data leak: Access to credentials SQL Injection WordPress SEO by Yoast plugin 1.7.2 is vulnerable on sweden.se
  123. 4121 07 Sweden, Slottsbacken Vulnerable CMS Full access to production data Data leak: Access to credentials SQL Injection WordPress SEO by Yoast plugin 1.7.2 is vulnerable on si.se
  124. 4122 07 The Netherlands, Hilversum Vulnerable CMS Full access to production data Data leak: Access to credentials SQL Injection WordPress <= 4.2.3 – comments SQL Injection
  125. 4123 07 The Netherlands, Amsterdam Vulnerable CMS Full access to production data Data leak: Access to credentials SQL Injection WordPress <= 4.2.3 – comments SQL Injection / CloudFlare does not detect
  126. 4124 07 The Netherlands, Amsterdam Vulnerable CMS Full access to production data Data leak: Access to credentials SQL Injection WordPress <= 4.2.3 – comments SQL Injection
  127. 4125 07 The Netherlands, Rotterdam Vulnerable CMS Full access to production data Data leak: Access to credentials SQL Injection WordPress <= 4.2.3 – comments SQL Injection
  128. 4126 07 The Netherlands, Vught Vulnerable CMS Full access to production data Data leak: Access to credentials SQL Injection WordPress <= 4.2.3 – comments SQL Injection
  129. 4127 07 The Netherlands, Enschede Vulnerable CMS Full access to production data Data leak: Access to credentials SQL Injection WordPress <= 4.2.3 – comments SQL Injection
  130. 4128 07 The Netherlands, Utrecht Vulnerable CMS Full access to production data Data leak: Access to credentials SQL Injection WordPress <= 4.2.3 – comments SQL Injection
  131. 4129 07 The Netherlands, Heerlen Vulnerable CMS Full access to production data Data leak: Access to credentials SQL Injection WordPress <= 4.2.3 – comments SQL Injection
  132. 4130 07 The Netherlands, Den Haag Vulnerable CMS Full access to production data Data leak: Access to credentials SQL Injection WordPress <= 4.2.3 – comments SQL Injection
  133. 4131 07 UK, London Vulnerable service: default setting(s) / default credentials Full access to development environment Open MongoDB Full access to [redacted] and [redacted]-dev databases
  134. 4132 07 The Netherlands, Amsterdam Vulnerable service: default setting(s) / default credentials Full access to production data Data leak: > 10,000 customer/member records Open MongoDB Full access to website and GridFS
  135. 4133 07 The Netherlands, Middelburg Vulnerable service: not patched with known vulnerabilities Information disclosure: Sensitive files OpenSSL 1.0.1f CVE-2014-0160 Heartbleed via [redacted]
  136. 4134 07 The Netherlands, Middelburg Vulnerable service: not patched with known vulnerabilities Information disclosure: Sensitive files OpenSSL 1.0.1f CVE-2014-0160 Heartbleed via [redacted]
  137. 4135 07 The Netherlands, Middelburg Vulnerable service: not patched with known vulnerabilities Information disclosure: Sensitive files OpenSSL 1.0.1f CVE-2014-0160 Heartbleed via [redacted]
  138. 4136 07 The Netherlands, Middelburg Vulnerable service: not patched with known vulnerabilities Information disclosure: Sensitive files OpenSSL 1.0.1f CVE-2014-0160 Heartbleed via [redacted]
  139. 4137 07 US, Providence Vulnerable service: default setting(s) / default credentials Full access to production data Data leak: > 1,000 customer/member records Open MongoDB Full access to production environment
  140. 4138 07 US, New York Vulnerable service: default setting(s) / default credentials Full access to production data Data leak: > 1,000 customer/member records missing encryption of sensitive data Open MongoDB Full access to production environment, admin credentials were plain-text
  141. 4139 07 The Netherlands, Leiden Information disclosure: Sensitive files Information disclosure via SVN Leaking private key [redacted
  142. 4140 07 India, New Delhi Vulnerable service: default setting(s) / default credentials Full access to production data Data leak: > 10,000,000 customer/member records Open MongoDB 21 million customer records, financial transactions. Full access on Prod & staging
  143. 4141 07 India, Chennai Information disclosure: Open webdirectory Information disclosure: Sensitive files Information disclosure via open webdir server.crt server.key leaking via /csf/ directory
  144. 4142 07 United Arab Emirates Information disclosure: Open webdirectory Information disclosure: Sensitive files Information disclosure via open webdir ssl.key (private) via /tmp/SSL/ssl.key
  145. 4143 07 Philippines, Quezon Information disclosure: Open webdirectory Information disclosure: Sensitive files Information disclosure via open webdir private.key via /cert/ssl/
  146. 4144 07 US, New Jersey Vulnerable service: default setting(s) / default credentials Full access to production data Data leak: > 100,000 customer/member records Data leak: Access to confidential data Open MongoDB Full access to staging env: > 800k usr accounts & financial transactions
  147. 4148 07 Spain, Barcelona Vulnerable service: default setting(s) / default credentials Full access to production data Data leak: > 100 customer/member records Open MongoDB Full access to webste cms and APP backend
  148. 4149 07 US, Oakridge Information disclosure: Open webdirectory Information disclosure: Sensitive files Information disclosure via open webdir Leaking private key via https://users.[redacted].gov/key.pem
  149. 4150 07 England, London Vulnerable service: default setting(s) / default credentials Full access to staging data Data leak: > 1,000 customer/member records Open MongoDB Full access to staging server
  150. 4151 07 Germany, Doebeln Vulnerable service: default setting(s) / default credentials Information disclosure: Sensitive files Data leak: Access to credentials Information disclosure: Whatsapp x leaks several gov credentials via Whatsapp backup [msgstore.db's] on Abyss Web Server X1
  151. 4152 07 US, Cambridge Information disclosure: Open webdirectory Information disclosure: Sensitive files missing encryption of sensitive data Information disclosure: Dropbox copy [redacted]admin credentials leaked via http://[redacted]/dropbox/accounts
  152. 4153 07 US, Virginia Beach Information disclosure: Open webdirectory Information disclosure: Sensitive files missing encryption of sensitive data Information disclosure: Dropbox copy credentials: webserver, email, etc leaked via www.[redacted].com/dropbox/
  153. 4154 07 The Netherlands, Amsterdam Information disclosure: Open webdirectory Data leak: Access to financial data Data leak: > 100 customer/member records Website: hosting hidden Phishing site Phising site: AmericanExpress [redacted].nl: dump file found in /dropbox and reported to American Express anti fraud
  154. 4155 07 England, Barnsley Vulnerable CMS Access to CMS / CRM Wordpress plugin W3 Total Cache http://www.[redacted].nl/wp-content/w3tc/dbcache/ - Vulnerable for CVE-2014-9414
  155. 4156 07 Belgium, Antwerp Information disclosure: Open webdirectory Full access to production data Data leak: > 100 customer/member records Information disclosure: Sensitive files Information disclosure via open webdir 213 [beep!] case files readable via [redacted].be/accounts/[beep!]/
  156. 4157 07 US, Illinois Information disclosure: Open webdirectory Data leak: Access to confidential data Data leak: > 10,000 customer/member records Access to email backup Information disclosure via open webdir Email migration (full dump) via http://www.[redacted]/accounts/email/migrate/
  157. 4158 07 France, Paris Vulnerable service: default setting(s) / default credentials Full access to production data Data leak: > 1,000 customer/member records Data leak: Access to confidential data Open MongoDB Full access to > 203 Gb of production data – backend [redacted] app
  158. 4159 07 US, Washington Vulnerable service: not patched with known vulnerabilities Full access to production data Data leak: > 1,000,000 customer/member records Data leak: Access to confidential data Oracle Forms & Reports 11.1 – RCE vulnerable Vulnerable for CVE-2012-3152 via http://[redacted].dot.gov/reports/rwservlet
  159. 4160 07 Argentina, Córdoba Vulnerable service: not patched with known vulnerabilities Full access to production data Data leak: > 100 customer/member records Information disclosure: Sensitive files Oracle Forms & Reports 11.1 – RCE vulnerable Vulnerable for CVE-2012-3152 via http://[redacted].edu.ar/reports/rwservlet
  160. 4161 07 India, Mumbai Vulnerable service: not patched with known vulnerabilities Full access to production data Data leak: > 1,000 customer/member records Information disclosure: Sensitive files Oracle Forms & Reports 11.1 – RCE vulnerable Vulnerable for CVE-2012-3152 via http://[redacted].in/reports/rwservlet
  161. 4162 07 Greece, Athens Vulnerable service: not patched with known vulnerabilities Full access to production data Data leak: > 100 customer/member records Information disclosure: Sensitive files Oracle Forms & Reports 11.1 – RCE vulnerable Vulnerable for CVE-2012-3152 via http://[redacted].gr/reports/rwservlet
  162. 4163 07 Portugal, Lisbon Vulnerable service: not patched with known vulnerabilities Full access to production data Data leak: > 1,000 customer/member records Information disclosure: Sensitive files Oracle Forms & Reports 11.1 – RCE vulnerable Vulnerable for CVE-2012-3152 via http://[redacted].pt/reports/rwservlet
  163. 4164 07 Belgium, Brussels Vulnerable service: not patched with known vulnerabilities Full access to production data Data leak: Access to confidential data Information disclosure: Sensitive files Oracle Forms & Reports 11.1 – RCE vulnerable Vulnerable for CVE-2012-3152 via http://[redacted].eu/reports/rwservlet
  164. 4165 07 US, Columbus Vulnerable service: not patched with known vulnerabilities Full access to production data Data leak: > 1,000 customer/member records Information disclosure: Sensitive files Oracle Forms & Reports 11.1 – RCE vulnerable Vulnerable for CVE-2012-3152 via http://[redacted].us/reports/rwservlet
  165. 4166 07 Colombia, Bogotá Vulnerable service: not patched with known vulnerabilities Full access to production data Data leak: > 1,000 customer/member records Information disclosure: Sensitive files Oracle Forms & Reports 11.1 – RCE vulnerable Vulnerable for CVE-2012-3152 via http://[redacted].gov.co/reports/rwservlet
  166. 4167 07 Canada, Québec Vulnerable service: not patched with known vulnerabilities Full access to production data Data leak: > 10,000 customer/member records Information disclosure: Sensitive files Oracle Forms & Reports 11.1 – RCE vulnerable Vulnerable for CVE-2012-3152 via https://[redacted].ca/reports/rwservlet
  167. 4168 07 Jordan, Amman Vulnerable service: not patched with known vulnerabilities Full access to production data Data leak: Access to confidential data Information disclosure: Sensitive files Oracle Forms & Reports 11.1 – RCE vulnerable Vulnerable for CVE-2012-3152 via http://[redacted].gov.jo:xxxx/reports/rwservlet
  168. 4169 07 Colombia, Bogotá Vulnerable service: not patched with known vulnerabilities Full access to production data Data leak: Access to confidential data Information disclosure: Sensitive files Oracle Forms & Reports 11.1 – RCE vulnerable Vulnerable for CVE-2012-3152 via http://[redacted].com:xxxx/reports/rwservlet
  169. 4170 07 China, Guangzhou Vulnerable service: default setting(s) / default credentials Full access to production data Data leak: > 10,000,000 customer/member records Data leak: Access to confidential data Open MongoDB Full access to production environment (>32, million records) devices, customers, financial transactions
  170. 4171 07 England, Barnsley Vulnerable service: default setting(s) / default credentials Full access to production data Full access to production data Data leak: Access to credentials Open MongoDB Full access to production data via [beep!].[redacted].co.uk
  171. 4172 07 Singapore Vulnerable service: default setting(s) / default credentials Full access to production data Full access to production data Data leak: Access to financial data Open MongoDB Full access to production environment (>2, million records) customers, financial transactions
  172. 4173 07 Spain, Madrid Vulnerable service: default setting(s) / default credentials Full access to production data Full access to production data Data leak: Access to credentials Open MongoDB Full access to Beta production environment
  173. 4174 07 Argentina, Buenos Aires Vulnerable service: default setting(s) / default credentials Full access to production data Full access to production data Data leak: Access to credentials Open MongoDB Full access to Beta production enviroment via http://[redacted]/
  174. 4175 07 Nigeria, Abuja Information disclosure: Open webdirectory Data leak: Access to credentials Information disclosure: readable configs Information disclosure via open webdir http://www.[redacted].com/Backup/homedir/.cpanel/datastore/
  175. 4176 07 US, St. Charles Information disclosure: Open webdirectory Data leak: Access to credentials Information disclosure: readable configs Open Webdir /backup/ http://www.[redacted].com/backup-[redacted]/homedir/.cpanel-datastore/
  176. 4177 07 Germany, Zurich Information disclosure: Sensitive files Data leak: Access to credentials Access to database (dump) Mysql dump http://www.[redacted].ch/content/../../../users.dump.txt
  177. 4178 07 US, Los Angeles Information disclosure: Sensitive files Data leak: Access to credentials Access to database (dump) Mysql dump [redacted].edu/Users/admin/users.txt
  178. 4179 07 Paraguay, San Lorenzo Vulnerable service: not patched with known vulnerabilities SCADA: Admin control VxWorks 6.9 Vulnerable for CVE-2013-0714
  179. 4180 07 Paraguay, Mariano Roque Alonso Vulnerable service: not patched with known vulnerabilities SCADA: Admin control VxWorks 6.9 Vulnerable for CVE-2013-0714
  180. 4181 07 Paraguay, Fernando De La Mora Vulnerable service: not patched with known vulnerabilities SCADA: Admin control VxWorks 6.9 Vulnerable for CVE-2013-0714
  181. 4182 07 Paraguay, San Lorenzo Vulnerable service: not patched with known vulnerabilities SCADA: Admin control VxWorks 6.9 Vulnerable for CVE-2013-0714
  182. 4183 07 Paraguay, San Lorenzo Vulnerable service: not patched with known vulnerabilities SCADA: Admin control VxWorks 6.9 Vulnerable for CVE-2013-0714
  183. 4184 07 Paraguay, Mariano Roque Alonso Vulnerable service: not patched with known vulnerabilities SCADA: Admin control VxWorks 6.9 Vulnerable for CVE-2013-0714
  184. 4185 07 Paraguay, Fernando De La Mora Vulnerable service: not patched with known vulnerabilities SCADA: Admin control VxWorks 6.9 Vulnerable for CVE-2013-0714
  185. 4186 07 Paraguay, Ciudad Del Este Vulnerable service: not patched with known vulnerabilities SCADA: Admin control VxWorks 6.9 Vulnerable for CVE-2013-0714
  186. 4187 07 Paraguay, Luque Vulnerable service: not patched with known vulnerabilities SCADA: Admin control VxWorks 6.9 Vulnerable for CVE-2013-0714
  187. 4188 07 Paraguay, San Lorenzo Vulnerable service: not patched with known vulnerabilities SCADA: Admin control VxWorks 6.9 Vulnerable for CVE-2013-0714
  188. 4189 07 Paraguay, Mariano Roque Alonso Vulnerable service: not patched with known vulnerabilities SCADA: Admin control VxWorks 6.9 Vulnerable for CVE-2013-0714
  189. 4190 07 Paraguay, Fernando De La Mora Vulnerable service: not patched with known vulnerabilities SCADA: Admin control VxWorks 6.9 Vulnerable for CVE-2013-0714
  190. 4191 07 Paraguay, Ciudad Del Este Vulnerable service: not patched with known vulnerabilities SCADA: Admin control VxWorks 6.9 Vulnerable for CVE-2013-0714
  191. 4192 07 Paraguay, Luque Vulnerable service: not patched with known vulnerabilities SCADA: Admin control VxWorks 6.9 Vulnerable for CVE-2013-0714
  192. 4193 07 Paraguay, Luque Vulnerable service: not patched with known vulnerabilities SCADA: Admin control VxWorks 6.9 Vulnerable for CVE-2013-0714
  193. 4194 07 Paraguay, Fernando De La Mora Vulnerable service: not patched with known vulnerabilities SCADA: Admin control VxWorks 6.9 Vulnerable for CVE-2013-0714
  194. 4195 07 Paraguay, Ciudad Del Este Vulnerable service: not patched with known vulnerabilities SCADA: Admin control VxWorks 6.9 Vulnerable for CVE-2013-0714
  195. 4196 07 Paraguay, Luque Vulnerable service: not patched with known vulnerabilities SCADA: Admin control VxWorks 6.9 Vulnerable for CVE-2013-0714
  196. 4197 07 Paraguay, Fernando De La Mora Vulnerable service: not patched with known vulnerabilities SCADA: Admin control VxWorks 6.9 Vulnerable for CVE-2013-0714
  197. 4198 07 Paraguay, Ciudad Del Este Vulnerable service: not patched with known vulnerabilities SCADA: Admin control VxWorks 6.9 Vulnerable for CVE-2013-0714
  198. 4199 07 Paraguay, Luque Vulnerable service: not patched with known vulnerabilities SCADA: Admin control VxWorks 6.9 Vulnerable for CVE-2013-0714
  199. 4200 07 Singapore Vulnerable service: default setting(s) / default credentials Full access to production data Data leak: > 100,000 customer/member records Data leak: Access to confidential data Open MongoDB Full access to > 1000 Gb of production data
  200. 4201 08 US, New Jersey Cross Site Scripting (XSS) XSS on main website via FreeMarker template --%3E%3C/style%3E%3C/scRiPt%3E%3CscRiPt%3Ealert%28%27XSS%20found%20by%200xDUDE%20%27%29%3C/scRiPt%3E
  201. 4202 08 US, New York Vulnerable service: default setting(s) / default credentials Full access to development environment Data leak: Access to credentials Bad design: Weak password storage: one-Way Hash without salt Open MongoDB Full access to development server
  202. 4203 08 Serbia, Golubinci SCADA: Admin control VxWorks 6.9 Vulnerable for CVE-2013-0714
  203. 4204 08 Serbia, Golubinci SCADA: Admin control VxWorks 6.9 Vulnerable for CVE-2013-0714
  204. 4205 08 Serbia, Golubinci SCADA: Admin control VxWorks 6.9 Vulnerable for CVE-2013-0714
  205. 4206 08 Serbia, Beograd SCADA: Admin control VxWorks 6.9 Vulnerable for CVE-2013-0714
  206. 4207 08 Serbia, Beograd SCADA: Admin control VxWorks 6.9 Vulnerable for CVE-2013-0714
  207. 4208 08 Serbia, Beograd SCADA: Admin control VxWorks 6.9 Vulnerable for CVE-2013-0714
  208. 4209 08 US, New York Vulnerable service: default setting(s) / default credentials Full access to production data Data leak: > 10,000,000 customer/member records missing encryption of sensitive data Open MongoDB Full access to entire production data via 7 open mongoDB (>1TB) / 69,556,758 customers
  209. 4210 08 US, California Vulnerable service: default setting(s) / default credentials Full access to production data Data leak: Access to confidential data Bad design: Weak password storage: one-Way Hash without salt Open MongoDB Full access to entire security sensor data belonging to law firm [redacted]
  210. 4211 08 China, Beijing Vulnerable service: default setting(s) / default credentials Full access to production data Data leak: > 1,000,000 customer/member records Data leak: Access to confidential data Open MongoDB Full access to entire production date(>2,6GB) /1,000,000 records)
  211. 4212 08 The Netherlands, Leeuwarden Vulnerable service: default setting(s) / default credentials Full access to production data Open MongoDB Full access to “collection” production data
  212. 4213 08 Denmark, Vejle Vulnerable service: default setting(s) / default credentials Full access to production data Data leak: Access to credentials Bad design: Weak password storage: one-Way Hash without salt Open MongoDB Full access to 21.2 Gb of production data: >5 million records.
  213. 4214 08 Denmark, Copenhagen Vulnerable service: default setting(s) / default credentials Full access to production data Data leak: > 100 customer/member records Bad design: Weak password storage: one-Way Hash without salt Open MongoDB Full access to customer data
  214. 4215 08 Denmark, Erritsø Vulnerable service: no authorization required SCADA: Admin control VNC: no authentication Access to water-cooler control panel
  215. 4216 08 The Netherlands, Middelburg Vulnerable service: default setting(s) / default credentials Access to system controls Bad design: Weak password storage: one-Way Hash without salt Open MongoDB Access to obsolete logging platform ([beep!].[redacted].nl)
  216. 4217 08 US, Phoenix Vulnerable service: default setting(s) / default credentials Full access to production data Data leak: > 10,000,000 customer/member records Open MongoDB Access to customer data: Athletic data (150,000,000 results – 300,000 events)
  217. 4218 08 Denmark, Gentofte Vulnerable service: default setting(s) / default credentials Full access to production data Data leak: > 100 customer/member records Bad design: Weak password storage: one-Way Hash without salt Open MongoDB Full access to customer data. Ownership was difficult to pin point
  218. 4219 08 Denmark, Odense Vulnerable service: default setting(s) / default credentials Access to CMS / CRM Data leak: > 100 customer/member records Bad design: Weak password storage: one-Way Hash without salt Open MongoDB Full access to production: Sitecore and CRM
  219. 4220 08 Denmark, Skanderborg Vulnerable service: default setting(s) / default credentials Access to CMS / CRM Data leak: > 100 customer/member records Data leak: Access to confidential data Open MongoDB Full access to [redacted].com website
  220. 4221 08 Denmark, Virum Vulnerable service: default setting(s) / default credentials Access to CMS / CRM Data leak: > 100 customer/member records Data leak: Access to confidential data Open MongoDB Full access to online portal
  221. 4222 08 Denmark, Karlslunde Vulnerable service: default setting(s) / default credentials Access to CMS / CRM Data leak: > 100 customer/member records Data leak: Access to confidential data Open MongoDB Full access to customer data
  222. 4223 08 Denmark, Tønder Vulnerable service: default setting(s) / default credentials Access to webhosting control panel Information disclosure: readable configs Data leak: Access to confidential data Open MongoDB Full access to ISP Control dashboard via MongoDB
  223. 4224 08 Denmark Vulnerable service: default setting(s) / default credentials Access to CMS / CRM Data leak: > 100 customer/member records Data leak: Access to confidential data Open MongoDB Full access to online portal, customer data, prod, dev, test
  224. 4225 08 Denmark, Gram Vulnerable service: default setting(s) / default credentials Full access to test environment Website: hosting malware Open MongoDB Test server. Default MongoDB. Malware found in the GridFS
  225. 4226 08 Denmark, Erritsø Vulnerable service: not patched with known vulnerabilities SCADA: Admin control VxWorks 6.5 Vulnerable for CVE-2013-0714
  226. 4227 08 Denmark, Erritsø Vulnerable service: not patched with known vulnerabilities SCADA: Admin control VxWorks 6.9 Vulnerable for CVE-2013-0714
  227. 4228 08 Denmark, Erritsø Vulnerable service: not patched with known vulnerabilities SCADA: Admin control VxWorks 6.5 Vulnerable for CVE-2013-0714
  228. 4229 08 Denmark, Erritsø Vulnerable service: not patched with known vulnerabilities SCADA: Admin control VxWorks 6.9 Vulnerable for CVE-2013-0714
  229. 4230 08 Denmark, Erritsø Vulnerable service: not patched with known vulnerabilities SCADA: Admin control VxWorks 6.5 Vulnerable for CVE-2013-0714
  230. 4231 08 Denmark, Erritsø Vulnerable service: not patched with known vulnerabilities SCADA: Admin control Moxa EDR-G903 CVE-2012-4712: Unpatched firmware: hardcoded account and remote access
  231. 4232 08 Denmark, Erritsø Vulnerable service: not patched with known vulnerabilities SCADA: Admin control Moxa EDR-G903 CVE-2012-4712: Unpatched firmware: hardcoded account and remote access
  232. 4233 08 Denmark, Erritsø Vulnerable service: not patched with known vulnerabilities SCADA: Admin control Moxa EDR-G903 CVE-2012-4712: Unpatched firmware: hardcoded account and remote access
  233. 4234 08 Denmark, Erritsø Vulnerable service: not patched with known vulnerabilities SCADA: Admin control Moxa EDR-G903 CVE-2012-4712: Unpatched firmware: hardcoded account and remote access
  234. 4235 08 Denmark, Erritsø Vulnerable service: not patched with known vulnerabilities SCADA: Admin control Moxa EDR-G903 CVE-2012-4712: Unpatched firmware: hardcoded account and remote access
  235. 4236 08 Denmark, Erritsø Vulnerable service: not patched with known vulnerabilities SCADA: Admin control Moxa EDR-G903 CVE-2012-4712: Unpatched firmware: hardcoded account and remote access
  236. 4237 08 The Netherlands, Amsterdam Vulnerable service: default setting(s) / default credentials Full access to production data Data leak: > 100 customer/member records Data leak: Access to confidential data Open MongoDB Full access to > 7,2 Gb of production data
  237. 4238 08 The Netherlands, Amsterdam Vulnerable service: default setting(s) / default credentials Full access to development environment Data leak: > 100 customer/member records missing encryption of sensitive data Open MongoDB Full access to development server
  238. 4239 08 The Netherlands, Amsterdam Vulnerable service: default setting(s) / default credentials Full access to development environment Data leak: > 100 customer/member records Bad design: Weak password storage: one-Way Hash without salt Open MongoDB Full access to development server
  239. 4240 08 South Africa, Johannesburg Vulnerable service: default setting(s) / default credentials Full access to production data Data leak: > 1,000,000 customer/member records Data leak: Access to confidential data Open MongoDB Full access to production server: online biddings and financial transactions
  240. 4241 08 Brazil, Rio de Janeiro Vulnerable service: not patched with known vulnerabilities Access to Telephone system (VOIP) Avaya Aura Application Server 5300 SIP Core 2.0 Vulnerable for CVE-2015-0235 – Ghost
  241. 4242 08 England, London Vulnerable service: not patched with known vulnerabilities Access to Telephone system (VOIP) Avaya Aura Application Server 5300 SIP Core 2.1 Vulnerable for CVE-2015-0235 – Ghost – According to BT a legacy server. Node had been replaced
  242. 4243 08 The Netherlands, Amsterdam Vulnerable service: default setting(s) / default credentials Full access to production data Data leak: > 100 customer/member records Use of a weak/bad Cryptographic algorithm Open MongoDB Full access to production server: accounts, transactions, phonebooks, voicemails
  243. 4244 08 Malaysia, Kuala Lumpur Vulnerable CMS Command Injection (remote) Data leak: Access to credentials /cgi-bin/controls/admin.cgi is vulnerable CVE-2014-6271 - Shellshock
  244. 4245 08 Malaysia, Kuala Lumpur Vulnerable CMS Command Injection (remote) Data leak: Access to credentials /cgi-bin/report/generate.cgi is vulnerable CVE-2014-6271 - Shellshock
  245. 4246 08 Malaysia, Kuala Lumpur Vulnerable CMS Command Injection (remote) Data leak: Access to credentials /cgi-bin//use_stats.cgi is vulnerable CVE-2014-6271 - Shellshock
  246. 4247 08 Hungary, Budapest Vulnerable CMS Command Injection (remote) Data leak: Access to credentials /cgi-bin/webdispatcher.cgi is vulnerable CVE-2014-6271 - Shellshock
  247. 4248 08 Hungary, Budapest Vulnerable CMS Command Injection (remote) Data leak: Access to credentials /cgi-bin/shinji? Is vulnerable CVE-2014-6271 - Shellshock
  248. 4249 08 Hungary, Budapest Vulnerable CMS Command Injection (remote) Data leak: Access to credentials /cgi-bin/admin? Is vulnerable CVE-2014-6271 - Shellshock
  249. 4250 08 US, Denver Vulnerable service: default setting(s) / default credentials Full access to production data Data leak: > 1,000 customer/member records Data leak: Access to credentials Open MongoDB Full access to customers (1,742) credential database
  250. 4251 08 France, Bois-le-roi Vulnerable service: default setting(s) / default credentials Access to system controls Poor implementation: No privacy Netwave IP cam (default) Controllable videofeed.
  251. 4252 08 The Netherlands, Eefde Vulnerable CMS Access to CMS / CRM Website: hosting malware WordPress <= 4.2 vulnerability, Plugin contact-form-7 4.1.1 Site compromised: spreading malware via http://[redacted].nl/[beep!]/
  252. 4253 08 The Netherlands, The Hague Information disclosure: Open webdirectory Data leak: Access to credentials Bad design: Weak password storage: one-Way Hash without salt Information disclosure via open webdir System settings and credentials leaked via http://[ping!].[redacted].nl/[beep!]/
  253. 4254 08 The Netherlands, Amsterdam Vulnerable service: default setting(s) / default credentials Data leak: Access to credentials missing encryption of sensitive data Open MongoDB Full access to development server: leaking plain-text admin credentials
  254. 4255 08 Poland, Wrocław Vulnerable service: default setting(s) / default credentials Open MongoDB Full access to production data
  255. 4256 08 Jordan, Amman SCADA: Admin control VxWorks5.5.1 Vulnerable for CVE-2013-0714
  256. 4257 08 Jordan, Irbid Information disclosure: Open webdirectory Full access to production data Data leak: Access to confidential data Bad construction: missing encryption of sensitive data Open FTP (anon) – CRUD Office files: power grid designs, work schedules, etc
  257. 4258 08 UK, London Vulnerable service: default setting(s) / default credentials Full access to development environment Data leak: Access to confidential data Bad construction: missing encryption of sensitive data OpenMongoDB Full access to a replicated database. Most likely a development server
  258. 4259 08 UK, London Vulnerable service: default setting(s) / default credentials Full access to production data Data leak: > 100 customer/member records OpenMongoDB
  259. 4260 08 Canada, Delta Information disclosure: Open webdirectory Information disclosure: Sensitive files Data leak: Access to credentials Information disclosure via open webdir drivers license and spreadsheet with credentials leaked via http://www.[redacted].net/Attachments/[beep!]/Other%20Documents/
  260. 4261 08 Poland, Warsaw Information disclosure: Open webdirectory Information disclosure: Sensitive files Data leak: Access to confidential data Information disclosure via open webdir Confidential documents leaked via https://[redacted].gov.pl/_sekret/
  261. 4262 08 India, Mumbai Vulnerable service: default setting(s) / default credentials Access to CMS / CRM Data leak: > 10,000 customer/member records Data leak: Access to confidential data OpenMongoDB Full access to entire production environment
  262. 4263 08 The Netherlands, Enschede Vulnerable service: no authorization required Access to Telephone system (VOIP) Poor implementation: No privacy VOIP phone management interface without authentication [redacted]
  263. 4264 08 The Netherlands, Enschede Vulnerable service: no authorization required Access to Telephone system (VOIP) Poor implementation: No privacy VOIP phone management interface without authentication [redacted]
  264. 4265 08 The Netherlands, Enschede Vulnerable service: no authorization required Access to Telephone system (VOIP) Poor implementation: No privacy VOIP phone management interface without authentication [redacted]
  265. 4266 08 The Netherlands, The Hague Vulnerable service: no authorization required Access to Telephone system (VOIP) Poor implementation: No privacy VOIP phone management interface without authentication full control over external phone number +31[redacted]
  266. 4267 08 The Netherlands, The Hague Vulnerable service: no authorization required Access to Telephone system (VOIP) Poor implementation: No privacy VOIP phone management interface without authentication full control over internal phone extensions and contact lists and billing
  267. 4268 08 The Netherlands, Rotterdam Vulnerable service: not patched with known vulnerabilities Command Injection (remote) Access to CMS / CRM Vtiger CRM 5.x Vulnerable for unauthenticated RCE – CVE-2014-2268 via http://www.[redacted].nl/crm/
  268. 4269 08 The Netherlands, Amersfoort Vulnerable service: not patched with known vulnerabilities Command Injection (remote) Access to CMS / CRM Vtiger CRM 5.x Vulnerable for unauthenticated RCE – CVE-2014-2268 via http://[beep!].[redacted].nl/crm/index.php
  269. 4270 08 Brazil, Barueri Vulnerable service: not patched with known vulnerabilities Command Injection (remote) Access to CMS / CRM Vtiger CRM 5.x Vulnerable for unauthenticated RCE – CVE-2014-2268 via http://[beep!].[redacted].com.br/[beep!]/
  270. 4271 08 Italy, Rome Vulnerable service: default setting(s) / default credentials Full access to development environment Data leak: Access to confidential data missing encryption of sensitive data Open MongoDB EMS development, plain text credentials
  271. 4272 08 India, Chennai Vulnerable CMS Cross Site Scripting (XSS) WordPress <= 4.2 vulnerability Persistent Cross-Site Scripting (XSS)
  272. 4273 08 Poland, Zywiec Information disclosure: credentials (visual) Information disclosure: Sensitive files Plain text credentials Data leak: Access to credentials Information disclosure: photographed credentials credentials clearly visible in (unused) photo http://[redacted].gov.pl/resource/[beep!]
  273. 4274 08 Poland, Kraków Vulnerable CMS SQL Injection Data leak: Access to credentials SQL Injection (MySQL) SQLInjection via http://[redacted].gov.pl/en/[ping!]/
  274. 4275 08 Korea, Seongnam Vulnerable service: default setting(s) / default credentials Full access to production data Data leak: > 10,000 customer/member records missing encryption of sensitive data Open MongoDB Full access to production data
  275. 4276 08 Poland, Warsaw Remote File Inclusion Bad construction: URL Redirection to untrusted source Failure to Restrict URL Access: redirect via https://[redacted].gov.pl/[beep!]/[beep!]/DecisionAdditionalParameters.aspx?url=https://youtu.be/dQw4w9WgXcQ
  276. 4277 08 Poland, Warsaw Vulnerable service: not patched with known vulnerabilities Command Injection (remote) ProFTPD 1.3.5: ProFTPD 1.3.5 Mod_Copy CE Vulnerable for CVE-2015-3306
  277. 4278 08 Belgium, Antwerp Vulnerable service: default setting(s) / default credentials Full access to production data Data leak: Access to credentials Open MongoDB Full access to 4 production servers
  278. 4279 08 The Netherlands, Doetinchem Vulnerable service: default setting(s) / default credentials Full access to test environment Data leak: Access to credentials Open MongoDB Full access to obsolete development server
  279. 4280 08 Poland, Warsaw Vulnerable CMS Cross-Site Request Forgery (CSRF) Data leak: Access to credentials Joomla! 3.2.0: CSRF Vulnerable for CVE-2015-5397 via http://[redacted].gov.pl/
  280. 4281 08 Poland, Warsaw Information disclosure: Open webdirectory Information disclosure: Sensitive files Data leak: Access to credentials Information disclosure: config.xml Database credentials found via http://[redacted].gov.pl/[ping!]/config.xml
  281. 4282 08 Poland, Warsaw Cross Site Scripting (XSS) XSS: Reflective via http://[redacted].gov.pl/search?query=test%20--%20%3CIMG%20SRC=j&#X41vascript:alert('XSS')>
  282. 4283 08 Poland, Warsaw SQL Injection Data leak: Access to credentials Bad design: Weak password storage: one-Way Hash without salt SQL Injection via http://[ping!].[redacted].gov.pl/Download?id=['
  283. 4284 08 Poland, Warsaw Information disclosure: Sensitive files missing encryption of sensitive data Data leak: Access to credentials Information disclosure: full backup site in /web via http://[redacted].gov.pl/system/backup/
  284. 4285 08 Poland, Warsaw Vulnerable service: not patched with known vulnerabilities Local File Inclusion Data leak: Access to credentials Apache 2.4.7 [redacted].gov.pl is vulnerable for CVE-2014-0226
  285. 4286 08 Poland, Warsaw Vulnerable service: mis-configured Full access to production data Data leak: Access to confidential data missing encryption of sensitive data Open FTP (anon) – CRUD Access to police files
  286. 4287 08 Poland, Warsaw Vulnerable service: mis-configured Full access to production data Data leak: Access to confidential data missing encryption of sensitive data Open FTP (anon) – CRUD Access to police credentials
  287. 4288 08 South Africa, Benmore Vulnerable service: default setting(s) / default credentials Full access to production data Data leak: Access to credentials Plain text credentials Open MongoDB Full access to on-line client portal (plain-text credentials) via [beep!].[redacted].com
  288. 4289 08 The Netherlands, Nieuwegein Vulnerable service: default setting(s) / default credentials Full access to production data Data leak: > 100 customer/member records Open MongoDb Full access to development server
  289. 4290 08 Netherlands, Malden Vulnerable service: default setting(s) / default credentials Full access to production data Data leak: > 100 customer/member records Plain text credentials Open MongoDb Full access to back-end: plain-text credentials
  290. 4291 08 Colombia, Cali SCADA: Admin control VxWorks 6.5 Vulnerable for CVE-2013-0714
  291. 4292 08 Colombia, Pereira SCADA: Admin control VxWorks 6.5 Vulnerable for CVE-2013-0714
  292. 4293 08 Colombia, Cali SCADA: Admin control VxWorks 6.5 Vulnerable for CVE-2013-0714
  293. 4294 08 Colombia, Cali SCADA: Admin control VxWorks 6.5 Vulnerable for CVE-2013-0714
  294. 4295 08 Colombia, Bucaramanga SCADA: Admin control VxWorks 6.5 Vulnerable for CVE-2013-0714
  295. 4296 08 Latvia, Riga Vulnerable service: default setting(s) / default credentials Full access to production data Data leak: Access to credentials Bad design: Weak password storage: one-Way Hash without salt Open MongoDb Full access to production environment
  296. 4297 08 Singapore Vulnerable service: default setting(s) / default credentials Full access to production data Data leak: Access to confidential data Open MongoDb Full access to marketing data (>25GB)
  297. 4298 08 Italy, Rome Vulnerable service: default setting(s) / default credentials Full access to production data Data leak: > 10,000 customer/member records missing encryption of sensitive data Open MongoDb Full access to production environment (>1,5GB)
  298. 4299 08 Canada, Cornwall Vulnerable service: no authorization required Access to system controls SMB (filesharing): guest account with blank password, unauthenticated VNC Read access to office files (passwords.doc). VNC access to the [redacted]
  299. 4300 09 The Netherlands SCADA: Admin control Access to system controls --classified--- --classified---
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!