2024 matches found
Computrols CBAS Insufficient Encryption Strength Vulnerability
CBAS Web is a Web-based building management system BMS from Computrols. Computrols CBAS Web suffers from an insufficient encryption strength vulnerability. The vulnerability stems from the fact that this application stores passwords in a database using MD5 hashes, and the MD5 algorithm is...
Improper Signature Validation
The GnuTLS library provides support for cryptographic algorithms and for protocols such as Transport Layer Security TLS. It was found that GnuTLS did not check activation and expiration dates of CA certificates. This could cause an application using GnuTLS to incorrectly accept a certificate as...
Improper Signature Validation
The GnuTLS library provides support for cryptographic algorithms and for protocols such as Transport Layer Security TLS. It was found that GnuTLS did not check activation and expiration dates of CA certificates. This could cause an application using GnuTLS to incorrectly accept a certificate as...
Denial Of Service (DoS) CPU Consumption
mingw32-libxml2 is vulnerable to denial of service. The attack exists because it uses predictable hashing function causing intentional collisions and does not prevent the attacker inputing a malicious message to an XML service, resulting in longer processing time, which could lead to a denial of...
Denial Of Service (DoS)
PostgreSQL is an advanced object-relational database management system DBMS. A flaw was found in the way the crypt password hashing function from the optional PostgreSQL pgcrypto contrib module performed password transformation when used with the DES algorithm. If the password string to be hashed...
Facebook’s plain text misstep, and other password sins
Two days after an article by Brian Krebs disclosed that hundreds of millions of Facebook account passwords had been stored in plain text for years, Facebook released a statement indicating they hash and salt passwords, more or less in accordance with industry best practice. Plain text storage of...
The vulnerability of the microprogramming software used in Moxa EDS and IKS switches allows a intruder to gain unauthorized access to protected information.
The vulnerability of Moxa EDS and IKS microcontroller software lies in the use of a predictable cookie file during hashing. Exploiting this vulnerability allows an attacker operating remotely to gain unauthorized access to protected information...
Cybersecurity Teardown: Understanding Hash Values
We just started a new series called “Cybersecurity Teardown.” In this series, we’ll be ripping apart ideas and attacks, then reassembling them with a Carbon Black mindset. Each idea or attack will be broken down into three phases: What, Why, and How. In this first entry, I wanted to call your...
Rockstar Games: xss on https://www.rockstargames.com/GTAOnline/jp/screens/
In this report, the researcher identified a Cross-Site Scripting vulnerability on the /GTAOnline/jp/screens/ section of the website. Cross-Site Scripting can be exploited to steal cookies or help perform other attacks. This was possible because the page would blindly decode and attempt to load an...
Versa Networks: Passwords Stored Insecurely
In Versa Director, Versa Analytics and VOS, Passwords are not hashed using an adaptive cryptographic hash function or key derivation function prior to storage. Popular hashing algorithms based on the Merkle-Damgardconstruction such as MD5 and SHA-1 alone are insufficient in thwarting password...
Out-of-bounds
global.encryptPassword in bootstrap/global.js in CMSWing 1.3.7 relies on multiple MD5 operations for password hashing...
CVE-2019-7649
global.encryptPassword in bootstrap/global.js in CMSWing 1.3.7 relies on multiple MD5 operations for password hashing...
CVE-2019-7649
global.encryptPassword in bootstrap/global.js in CMSWing 1.3.7 relies on multiple MD5 operations for password hashing...
CVE-2019-7649
CMSWing 1.3.7 contains a weakness in global.encryptPassword (bootstrap/global.js) where password hashing relies on multiple MD5 operations. This is documented as a weak‑encryption vulnerability that can be brute‑forced, potentially allowing an attacker to break user passwords. The CVE is corrobor...
CVE-2019-7649
global.encryptPassword in bootstrap/global.js in CMSWing 1.3.7 relies on multiple MD5 operations for password hashing...
SSL/TLS Certificate Signed Using Weak Hashing Algorithm
The remote server uses an SSL/TLS certificate that has been signed using a cryptographically weak hashing algorithm e.g. MD2, MD4, MD5, or SHA1. These signature algorithms are known to be vulnerable to collision attacks. An attacker can exploit this to generate another certificate with the same...
Seven Must-Dos to Secure MySQL 8.0
Most database breaches are blamed on insiders such as employees who are either malicious or whose security has been compromised. In fact, most of these breaches are actually caused by poor security configuration and privilege abuse. Every new database version brings security upgrades. Use them...
The vulnerability of Juniper Advanced Threat Prevention’s microprogramming software, related to the use of the DES algorithm and a pre-installed password hashing modifier, allows attackers to gain access to protected information.
The vulnerability of Juniper Advanced Threat Prevention’s detection and prevention software lies in the use of the DES algorithm and a pre-installed modifier for password hashing. Exploiting this vulnerability could allow attackers to gain access to protected information...