CVE-2015-1832

XML external entity XXE vulnerability in the SqlXmlUtil code in Apache Derby before 10.12.1.1, when a Java Security Manager is not in place, allows context-dependent attackers to read arbitrary files or cause a denial of service resource consumption via vectors involving XmlVTI and the XML dataty...

Apache Derby External Entity Information Disclosure Vulnerability

Apache Derby is an open source database management system developed by the Apache Software Foundation. An information disclosure vulnerability exists in Apache Derby, which can be exploited by an attacker to obtain sensitive information or cause a denial of service...

School Bus Demolition Derby - Customized SSL, Dangerous filesystem permissions, WebView SSL handling enabled vulnerabilities

HackApp vulnerability scanner discovered that application School Bus Demolition Derby published at the 'play' market has multiple vulnerabilities...

Demolition Derby: Crash Racing - Customized SSL, Dangerous filesystem permissions, Redefined SSL Common Names verifier vulnerabilities

HackApp vulnerability scanner discovered that application Demolition Derby: Crash Racing published at the 'play' market has multiple vulnerabilities...

Zombie Derby - Base64 encoded String, Customized SSL, Dangerous filesystem permissions vulnerabilities

HackApp vulnerability scanner discovered that application Zombie Derby published at the 'play' market has multiple vulnerabilities...

Authentication Capture: DRDA (DB2, Informix, Derby)

This module provides a fake DRDA DB2, Informix, Derby server that is designed to capture authentication credentials. -- coding: binary -- This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule...

Nmap NSE net: drda-brute

Performs password guessing against databases supporting the IBM DB2 protocol such as Informix, DB2 and Derby SYNTAX: userdb: The filename of an alternate username database. drda-brute.threads: the amount of accounts to attempt to brute force in parallel default 10. unpwdb.userlimit: The maximum...

Apache Derby 'BUILTIN' Authentication Insecure Password Hashing

According to its self-reported version number, the installation of Apache Derby running on the remote server performs a transformation on passwords that removes half the bits from most of the characters before hashing. This leads to a large number of hash collisions, letting passwords be easily...

Apache Derby Information Disclosure Vulnerability

Apache Derby is prone to an information disclosure vulnerability. SPDX-FileCopyrightText: 2010 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:apache:derby";...

Apache Derby Information Disclosure Vulnerability

The host is running Apache Derby and is prone to information disclosure vulnerability. OpenVAS Vulnerability Test $Id: gbapachederbyinfodiscvuln.nasl 5263 2017-02-10 13:45:51Z teissa $ Apache Derby Information Disclosure Vulnerability Authors: Sooraj KS Copyright: Copyright c 2010 Greenbone...

CVE-2009-4269

The password hash generation algorithm in the BUILTIN authentication functionality for Apache Derby before 10.6.1.0 performs a transformation that reduces the size of the set of inputs to SHA-1, which produces a small search space that makes it easier for local and possibly remote attackers to...

UBUNTU-CVE-2009-4269

The password hash generation algorithm in the BUILTIN authentication functionality for Apache Derby before 10.6.1.0 performs a transformation that reduces the size of the set of inputs to SHA-1, which produces a small search space that makes it easier for local and possibly remote attackers to...

CVE-2009-4269

The password hash generation algorithm in the BUILTIN authentication functionality for Apache Derby before 10.6.1.0 performs a transformation that reduces the size of the set of inputs to SHA-1, which produces a small search space that makes it easier for local and possibly remote attackers to...

Design/Logic Flaw

The password hash generation algorithm in the BUILTIN authentication functionality for Apache Derby before 10.6.1.0 performs a transformation that reduces the size of the set of inputs to SHA-1, which produces a small search space that makes it easier for local and possibly remote attackers to...

CVE-2009-4269

CVE-2009-4269 affects Apache Derby BUILTIN authentication. The password hash generation transforms inputs before SHA-1, reducing the input space and enabling easier hash collisions, increasing the risk of password cracking. Affected versions include Derby prior to 10.6.1.0; remediation is to upgr...

CVE-2009-4269

The password hash generation algorithm in the BUILTIN authentication functionality for Apache Derby before 10.6.1.0 performs a transformation that reduces the size of the set of inputs to SHA-1, which produces a small search space that makes it easier for local and possibly remote attackers to...

CVE-2009-4269

The password hash generation algorithm in the BUILTIN authentication functionality for Apache Derby before 10.6.1.0 performs a transformation that reduces the size of the set of inputs to SHA-1, which produces a small search space that makes it easier for local and possibly remote attackers to...

drda-brute NSE Script

Performs password guessing against databases supporting the IBM DB2 protocol such as Informix, DB2 and Derby Script Arguments drda-brute.threads the amount of accounts to attempt to brute force in parallel default 10. drda-brute.dbname the database name against which to guess passwords default...

Nate Lawson: Crypto Strikes Back!

This Google Tech Talk features researcher Nate Lawson discussing recent vulnerabilities in crypto libraries, why public key cryptography is like a Ford Pinto in a demolition derby and the password-hashing mess created by Web 2.0 sites...

openSUSE 10 Security Update : derby (derby-4091)

Apache Derby did not determine schema privilege requirements during the DropSchemaNode bind phase, which allows remote authenticated users to execute arbitrary drop schema statements in SQL authorization mode. CVE-2006-7217 This update also brings a new requirement of a Java 1.5 JRE. %NASLMINLEVE...