CVE-2014-9970

jasypt before 1.9.2 allows a timing attack against the password hash comparison...

CVE-2016-7037

The verify function in Encryption/Symmetric.php in Malcolm Fell jwt before 1.0.3 does not use a timing-safe function for hash comparison, which allows attackers to spoof signatures via a timing attack...

Debian DLA-236-1 : wordpress security update

In the Debian squeeze-lts version of Wordpress, multiple security issues have been fixed : Remote attackers could... - ... upload files with invalid or unsafe names - ... mount social engineering attacks - ... compromise a site via cross-site scripting - ... inject SQL commands - ... cause denial...

[SECURITY] [DLA 236-1] wordpress security update

Package : wordpress Version : 3.6.1+dfsg-1deb6u6 CVE ID : CVE-2014-9031 CVE-2014-9033 CVE-2014-9034 CVE-2014-9035 CVE-2014-9036 CVE-2014-9037 CVE-2014-9038 CVE-2014-9039 CVE-2015-3438 CVE-2015-3439 CVE-2015-3440 Debian Bug : 783347 783554 770425 In the Debian squeeze-lts version of Wordpress,...

PHP Hash compare the presence of defects, the impact of a large number of Web site login authentication, Forgot Password and other business-critical-vulnerability warning-the black bar safety net

! The recent one is called“Magic Hash”PHP vulnerability may allow an attacker to illicitly obtain user account information. The vulnerability cause is PHP in a particular way the process is hash the string, the attacker can use its from to try and may get the password, bypassing the login...

Debian Security Advisory DSA 3085-1 (wordpress - security update)

Multiple security issues have been discovered in Wordpress, a web blogging tool, resulting in denial of service or information disclosure. More information can be found in the upstream advisory at https://wordpress.org/news/2014/11/wordpress-4-0-1/CVE-2014-9031 Jouko Pynnonen discovered an...

Mandriva Linux Security Advisory : wordpress (MDVSA-2014:233)

Updated wordpress package fixes security vulnerabilities : XSS in wptexturize via comments or posts, exploitable for unauthenticated users CVE-2014-9031. XSS in media playlists CVE-2014-9032. CSRF in the password reset process CVE-2014-9033. Denial of service for giant passwords. The phpass libra...

WordPress <= 4.0.0 - Multiple Vulnerabilities #1

There are multiple vulnerabilities in WordPress wp-login.php, such as cross site scripting, denial of service attacks, hash comparison, SSRF, CSRF. Because of these vulnerabilities, attackers can reset passwords by leveraging access to an e-mail account that received a password-reset message...

CVE-2013-7041

CVE-2013-7041 affects the Linux-PAM pam_userdb module, where a flaw in the password hash comparison (notably using case-insensitive comparison via strncasecmp) can enable brute-force credential guessing. Reported across multiple vendors (IBM FSM, Red Hat, SUSE, Debian/Ubuntu advisories) with low-...