Drupal resets 1 Million Passwords after Data Breach

A Drupal data breach was announced by the official Drupal Association, that Passwords for almost one million accounts on the Drupal.org website are being reset after hackers gained unauthorized access to sensitive user data. The security of the open source content management system has been...

LivingSocial Ups its Password Encryption After Breach

The popular daily deal site LivingSocial announced Monday it has abandoned the SHA1 hash for Blowfish’s bcrypt following a massive data breach that impacted 50 million customers. The company confirmed last weekend that its computer systems were attacked and thieves gained access to names, e-mail...

WordPress LeagueManager 3.8 SQL Injection Vulnerability

WordPress LeagueManager plugin version 3.8 suffers from a remote SQL injection vulnerability. Both an exploit along with patching recommendations are provided. !/usr/bin/ruby Exploit Title: WordPress LeagueManager Plugin v3.8 SQL Injection Google Dork: inurl:"/wp-content/plugins/leaguemanager/"...

Evernote Compromised, But Says No User Data Affected

Evernote, the online service that enables users to store and sync all kinds of data across multiple devices, has become the latest major Web property to suffer a serious intrusion. The company said on Saturday that attackers had compromised some user information, including email addresses and...

Educause Server Hit With Security Breach

A non-profit association for IT professionals in higher education announced Tuesday its server had been breached. Educause, which has 1,800 college and 300 corporate members, issued a warning that it had discovered a security breach sometime in February that may have compromised the hashed...

Hewlett-Packard LeftHand Virtual SAN Appliance Password Hash Disclosure Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of HP LeftHand Virtual SAN Appliance. Authentication is not required to exploit this vulnerability. The flaw exists within the hydra component which listens by default on TCP port 13841. The hydra...

SA-CONTRIB-2012-159 - Password policy - Information leakage of hashed passwords

This module provides a way to specify a certain level of password complexity aka. "password hardening" for user passwords on a system by defining a password policy. The Password policy module allows administrators to request users to enter a new password that does not match any of the previous X...

AndroidForums.com Hacked, User Credentials Stolen

An online forum for Android fans and developers was compromised and user account details stolen, according to a notice posted online on Tuesday. Phandroid.com, which operates Androidforums.com told users that hackers had breached a back end database that powers Androidforums.com, an online bullet...

SEC Consult SA-20120618-0 :: Western Digital ShareSpace WEB GUI Sensitive Data Disclosure

SEC Consult Vulnerability Lab Security Advisory 20120618-0 ======================================================================= title: WD ShareSpace WEB GUI Sensitive Data Disclosure product: WD ShareSpace network storage system vulnerable version: WD ShareSpace = v2.3.02 D and E series fixed...

Last.fm, Mum On Breach, Adopts 'More Rigorous' Password Security

Last.fm, the online music streaming service, said it has implemented ‘more rigorous’ security for customer account passwords in the wake of reports that some of those passwords had been leaked online. In a post on the company’s Website, Last.fm said that its investigation of reports that hashed o...

LinkedIn Investigating Password Leak That Could Affect 6.5 M

UPDATE Professional social networking site LinkedIn announced early Wednesday morning that it was looking into reports of stolen passwords, according to a post on their Twitter page. The tweet substantiates reports by several news outlets that a hacker was able to download the hashed passwords of...

Analysis of STRATFOR Passwords Reveals Shoddy Security

A partial analysis of another massive leak of user passwords has again shone a light on the scourge of weak passwords used to protect sensitive data in online accounts, according to a report by The Tech Herald. Using the leaked password list from STRATFOR, the open source intelligence service tha...

Nmap NSE net: wdb-version

Detects vulnerabilities and gathers information such as version numbers and hardware support from VxWorks Wind DeBug agents. Wind DeBug is a SunRPC-type service that is enabled by default on many devices that use the popular VxWorks real-time embedded operating system. H.D. Moore of Metasploit ha...

Getsimple CMS 2.01 2.02 - Administrative Credentials Disclosure

Getsimple CMS 2.01 2.02 - Administrative Credentials Disclosure Researcher: Michael Brooks Affecting: GetSimple CMS 2.01 and 2.02 Fixed:2.03 Vulnerability: Administrative Credentials Disclosure Vendor's Homepage: http://code.google.com/p/get-simple-cms download url for 2.01:...

wdb-version NSE Script

Detects vulnerabilities and gathers information such as version numbers and hardware support from VxWorks Wind DeBug agents. Wind DeBug is a SunRPC-type service that is enabled by default on many devices that use the popular VxWorks real-time embedded operating system. H.D. Moore of Metasploit ha...

Design/Logic Flaw

libxcrypt in SUSE openSUSE 11.0 uses the DES algorithm when the configuration specifies the MD5 algorithm, which makes it easier for attackers to conduct brute-force attacks against hashed passwords...

CVE-2008-3188

libxcrypt in SUSE openSUSE 11.0 uses the DES algorithm when the configuration specifies the MD5 algorithm, which makes it easier for attackers to conduct brute-force attacks against hashed passwords...

CVE-2008-3188

libxcrypt in SUSE openSUSE 11.0 uses the DES algorithm when the configuration specifies the MD5 algorithm, which makes it easier for attackers to conduct brute-force attacks against hashed passwords...

CVE-2008-1114

Vocera Communications wireless handsets, when using Protected Extensible Authentication Protocol PEAP, do not validate server certificates, which allows remote wireless access points to steal hashed passwords and conduct man-in-the-middle MITM attacks...

Mihalism Multi Host Download - 'Username' Blind SQL Injection

query"SELECT FROM ".SQLUSERSTABLE." WHERE username = '".$POST'username'."'"; Line 112: $DB-query"INSERT INTO ".SQLUSERSTABLE." VALUES'', '".$POST'username'."', '".md5$POST'userpass1'."', '', '".$SERVER'REMOTEADDR'."', '".$POST'useremail'."', '".$POST'private'."', '".time."', 'NORMAL',...