The account 'service' on the remote host has the default password 'service'. A remote attacker can exploit this issue to gain administrative access to the affected system.

The account 'admin' on the remote host has the default password 'adminIWSS85'. A remote attacker can exploit this issue to gain administrative access to the affected system.

The account 'admin' on the remote host has the default password 'QwestM0dem'. A remote attacker can exploit this issue to gain administrative access to the affected system.

Note that this username / password combination was found in the leaked source from the Mirai botnet.

The account '4Dgifts' has no password set. An attacker may use it to gain further privileges on this system.

The account 'OutOfBox' has no password set.  An attacker may use the account to gain further privileges on this system.

The account 'date' has no password set. An attacker can leverage this to gain access to the system.

The account 'glftpd' has the password 'glftpd'. An attacker may use this to gain further privileges on this system.

The account 'db2fenc1' has the password 'ibmdb2'. An attacker may use this to gain further privileges on this system.

The account 'db2inst1' has the password 'db2inst1'. An attacker may use this to gain further privileges on this system.

The account 'swift' has the password 'swift'.  An attacker may use this to gain further privileges on this system.

The EMC vApp Manager web application running on the remote host uses a default set of credentials ('smc' / 'smc'). An unauthenticated, remote attacker can exploit this issue to authenticate to the application and perform actions allowed by the default account. Specifically, the attacker can login and exploit a file upload RCE vulnerability (CVE-2018-1215) to cause remote code execution on the remote host.

The remote FTP server closes the connection when a command or argument is too long.  This is probably due to a buffer overflow and may allow an attacker to execute arbitrary code on the remote host.

The remote Oracle database server either contains one or more databases that use well-known System Identifiers (SIDs) or supports the 'services' command as a means of listing available SIDs on the affected system. 

Since an Oracle SID serves to uniquely identify a particular database on a given host and is required when connecting to an Oracle database, an attacker can leverage these SIDs to attempt to access databases on the remote host.

The version of MySQL or MariaDB running on the remote host has a user enumeration vulnerability.  A remote, unauthenticated attacker could exploit this to learn the names of valid database users.  This information could be used to mount further attacks.

The remote device is running RuggedCom RuggedOS (ROS). Using the user name 'factory' and a password derived from the MAC address of the device (which is present in the telnet login banner), Nessus was able to successfully log into the device via a built-in backdoor account.

The remote TURCK FTP server uses a set of default administrator credentials.

The remote instance of SQL Server has the default 'WinCCConnect' account enabled with its default password set.

An attacker may leverage this flaw to execute commands against the remote host, as well as read the content of the WinCC database if present.

The remote SSH server is affected by a security bypass vulnerability due to a flaw in the keyboard-interactive authentication mechanisms.
The kbdint_next_device() function in auth2-chall.c improperly restricts the processing of keyboard-interactive devices within a single connection. A remote attacker can exploit this, via a crafted keyboard-interactive 'devices' string, to bypass the normal restriction of 6 login attempts (MaxAuthTries), resulting in the ability to conduct a brute-force attack or cause a denial of service condition.

PostgreSQL contains a flaw that is triggered when attempting to  authenticate to the database with an empty password using a modified  or a non-libpq-based client. This allows a remote attacker to  bypass authentication mechanisms.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
94403	Default Password 'service' for 'service' Account	Nessus	Default Unix Accounts	2016/10/28	2022/4/11	critical
99246	Default Password 'adminIWSS85' for 'admin' Account	Nessus	Default Unix Accounts	2017/4/7	2022/4/11	critical
104974	Default Password 'QwestM0dem' for 'admin' Account	Nessus	Default Unix Accounts	2017/12/1	2022/4/11	critical
11243	Unpassworded '4Dgifts' Account	Nessus	Default Unix Accounts	2003/2/20	2022/4/11	critical
11244	Unpassworded 'OutOfBox' Account	Nessus	Default Unix Accounts	2003/2/20	2022/4/11	critical
11248	Unpassworded 'date' Account	Nessus	Default Unix Accounts	2003/2/20	2022/4/11	critical
11258	Default Password (glftpd) for 'glftpd' Account	Nessus	Default Unix Accounts	2003/2/20	2022/4/11	critical
11861	Default Password (ibmdb2) for 'db2fenc1' Account	Nessus	Default Unix Accounts	2003/10/1	2022/4/11	critical
11862	Default Password (db2inst) for 'db2inst1' Account	Nessus	Default Unix Accounts	2003/10/1	2022/4/11	critical
12116	Default Password (swift) for 'swift' Account	Nessus	Default Unix Accounts	2004/3/24	2022/4/11	critical
106849	EMC vApp Manager Default Credentials	Nessus	CGI abuses	2018/2/15	2019/11/8	critical
10084	Multiple FTP Server Command Handling Overflow	Nessus	FTP	1999/6/22	2024/1/16	critical
22074	Oracle Default SID	Nessus	Databases	2006/7/19	2025/12/15	info
64263	MySQL Protocol Remote User Enumeration	Nessus	Databases	2013/1/28	2018/11/15	medium
58991	RuggedCom RuggedOS Default 'factory' Account Backdoor	Nessus	SCADA	2012/6/12	2025/12/15	critical
72620	TURCK BL20/BL67 Hardcoded Admin Account	Nessus	SCADA	2014/2/10	2025/12/15	critical
47759	Siemens SIMATIC WinCC Default Password Authentication Bypass	Nessus	SCADA	2010/7/16	2025/12/15	high
86122	OpenSSH MaxAuthTries Bypass	Nessus	Misc.	2015/9/24	2024/3/27	high
104031	PostgreSQL Empty Password Handling Remote Authentication Bypass	Nessus	Databases	2017/10/20	2025/12/11	critical

检测

插件搜索

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

info

medium

critical

critical

high

high

critical