Security Bulletin: Offline dictionary attack vulnerability in IBM Spectrum Protect (formerly Tivoli Storage Manager) (CVE-2016-8937)

Summary IBM Spectrum Protect formerly Tivoli Storage Manager is vulnerable to an offline dictionary attack due to information disclosed during authentication. An attacker can gain full access to the IBM Spectrum Protect system allowing them to perform operations they may not be authorized to...

CVE-2018-5389

The Internet Key Exchange v1 main mode is vulnerable to offline dictionary or brute force attacks. Reusing a key pair across different versions and modes of IKE could lead to cross-protocol authentication bypasses. It is well known, that the aggressive mode of IKEv1 PSK is vulnerable to offline...

Authentication flaw

The Internet Key Exchange v1 main mode is vulnerable to offline dictionary or brute force attacks. Reusing a key pair across different versions and modes of IKE could lead to cross-protocol authentication bypasses. It is well known, that the aggressive mode of IKEv1 PSK is vulnerable to offline...

CVE-2018-5389

The Internet Key Exchange v1 main mode is vulnerable to offline dictionary or brute force attacks. Reusing a key pair across different versions and modes of IKE could lead to cross-protocol authentication bypasses. It is well known, that the aggressive mode of IKEv1 PSK is vulnerable to offline...

CVE-2018-5389: Weak Password Requirements

The Internet Key Exchange v1 main mode is vulnerable to offline dictionary or brute force attacks. Reusing a key pair across different versions and modes of IKE could lead to cross-protocol authentication bypasses. It is well known, that the aggressive mode of IKEv1 PSK is vulnerable to offline...

PT-2018-16941

Name of the Vulnerable Software and Affected Versions Internet Key Exchange IKE version 1 Description The Internet Key Exchange v1 main mode is susceptible to offline dictionary or brute force attacks. Reusing a key pair across different versions and modes of IKE could lead to cross-protocol...

Passit: app.passit.io is vulnerable against username enumeration

Summary: The application app.passit.io is vulnerable against username enumeration through the use of error messages and dictionary attack. Description: We noted that the application uses GET request with a rate limit of 60 seconds which is too broad. The application returns an error message that...

DEBIAN-CVE-2017-3225

Das U-Boot is a device bootloader that can read its configuration from an AES encrypted file. For devices utilizing this environment encryption mode, U-Boot's use of a zero initialization vector may allow attacks against the underlying cryptographic implementation and allow an attacker to decrypt...

CVE-2017-3225

Das U-Boot is a device bootloader that can read its configuration from an AES encrypted file. For devices utilizing this environment encryption mode, U-Boot's use of a zero initialization vector may allow attacks against the underlying cryptographic implementation and allow an attacker to decrypt...

CVE-2017-3225

CVE-2017-3225 concerns Das U-Boot, a device bootloader that reads configuration from an AES-CBC encrypted file. The vulnerability stems from U-Boot using a zero initialization vector (IV) in AES-CBC, which enables dictionary-like attacks on encrypted data to learn information about the ciphertext...

CVE-2017-3225: Generation of Predictable IV with CBC Mode

Das U-Boot is a device bootloader that can read its configuration from an AES encrypted file. For devices utilizing this environment encryption mode, U-Boot's use of a zero initialization vector may allow attacks against the underlying cryptographic implementation and allow an attacker to decrypt...

Design/Logic Flaw

DISPUTED An issue was discovered in Z-BlogPHP 2.0.0. zbsystem/cmd.php?act=verify relies on MD5 for the password parameter, which might make it easier for attackers to bypass intended access restrictions via a dictionary or rainbow-table attack. NOTE: the vendor declined to accept this as a valid...

CVE-2018-11209

An issue was discovered in Z-BlogPHP 2.0.0. zbsystem/cmd.php?act=verify relies on MD5 for the password parameter, which might make it easier for attackers to bypass intended access restrictions via a dictionary or rainbow-table attack. NOTE: the vendor declined to accept this as a valid issue...

CVE-2018-11209

An issue was discovered in Z-BlogPHP 2.0.0. zbsystem/cmd.php?act=verify relies on MD5 for the password parameter, which might make it easier for attackers to bypass intended access restrictions via a dictionary or rainbow-table attack. NOTE: the vendor declined to accept this as a valid issue...

CVE-2018-11209: Use of a Broken or Risky Cryptographic Algorithm

An issue was discovered in Z-BlogPHP 2.0.0. zbsystem/cmd.php?act=verify relies on MD5 for the password parameter, which might make it easier for attackers to bypass intended access restrictions via a dictionary or rainbow-table attack. NOTE: the vendor declined to accept this as a valid issue...

heinekingmedia StashCat Password Attack Vulnerability

heinekingmedia StashCat for Android is an Android-based enterprise communication software from the German company heinekingmedia. heinekingmedia StashCat suffers from a password attack vulnerability that stems from user passwords being hashed directly with SHA-512. By exploiting this vulnerabilit...

Passit: Weak Password Policy on Signup

Hi Team, i would like to let you know about password management issue. PoC: ======== 1. Navigate to signup page. 2. Fill you details and give password as simple as 123123. 3. You can see you will be registered and there is no strong enforcement. FIx: ------ Use complex password management. Regard...

CVE-2018-0021: Undefined Security Weakness

If all 64 digits of the connectivity association name CKN key or all 32 digits of the connectivity association key CAK key are not configured, all remaining digits will be auto-configured to 0. Hence, Juniper devices configured with short MacSec keys are at risk to an increased likelihood that an...

PT-2018-8570

Name of the Vulnerable Software and Affected Versions: Junos OS versions prior to 14.1R10 Junos OS versions prior to 14.1X53-D47 Junos OS versions prior to 15.1R4-S9 Junos OS versions prior to 15.1R6-S6 Junos OS versions prior to 15.1R7 Junos OS versions prior to 15.1X49-D100 Junos OS versions...

KeePass Simple Dictionary Password Enumerator Exploit

This is a simple perl script to perform dictionary attacks against the KeePass password manager. !/usr/bin/perl KeePass simple dictionary password enumerator Copyright 2018 c Todor Donev https://ethical-hacker.org/ https://facebook.com/ethicalhackerorg KeePass is a free open source password...