DSA-2150-1 request-tracker3.6 - salt password hashing

Bulletin has no description...

Implement salting of user passwords

Salting and Hashing of user passwords will require us to provide an upgrade path for users since all existing passwords will become invalid. This change should use the atlassian-security password encode library SEC-1...

GetSimple CMS 2.01 / 2.02 Credential Disclosure

Researcher: Michael Brooks Affecting: GetSimple CMS 2.01 and 2.02 Fixed:2.03 Vulnerability: Administrative Credentials Disclosure Vendor's Homepage: http://code.google.com/p/get-simple-cms download url for 2.01: http://www.box.net/get-simple/1/30435008/399754548 download svn for 2.02beta: svn...

CVE-2010-4302

/opt/rv/Versions/CurrentVersion/Mcu/Config/Mcu.val in Cisco Unified Videoconferencing UVC System 5110 and 5115, when the Linux operating system is used, uses a weak hashing algorithm for the 1 administrator and 2 operator passwords, which makes it easier for local users to obtain sensitive...

Design/Logic Flaw

/opt/rv/Versions/CurrentVersion/Mcu/Config/Mcu.val in Cisco Unified Videoconferencing UVC System 5110 and 5115, when the Linux operating system is used, uses a weak hashing algorithm for the 1 administrator and 2 operator passwords, which makes it easier for local users to obtain sensitive...

CVE-2010-4302

Cisco CVE-2010-4302 affects Cisco Unified Videoconferencing (UVC) System 5110/5115 on Linux, where /opt/rv/Versions/CurrentVersion/Mcu/Config/Mcu.val uses a weak hashing algorithm for administrator and operator passwords. This weak hashing enables local users to recover cleartext passwords of adm...

Hackers Leverage Cloud Computing to Crack Passwords Efficiently

On-demand cloud computing is a valuable tool for companies needing temporary computing capacity without long-term investment in fixed capital. However, this same convenience makes cloud computing useful to hackers. Many hacking activities involve cracking passwords, keys, or other forms of brute...

UBUNTU-CVE-2009-4269

The password hash generation algorithm in the BUILTIN authentication functionality for Apache Derby before 10.6.1.0 performs a transformation that reduces the size of the set of inputs to SHA-1, which produces a small search space that makes it easier for local and possibly remote attackers to...

PDF documents signature spoofing

Document is hashed in a way it's possible to created 2 differently looging documents with same signature...

US CERT Warns on VxWorks Flaws

The U.S. Computer Emergency Readiness Team has issued two warnings on flaws in the embedded systems’ OS technology VxWorks as discovered by researcher HD Moore. One flaw deals with weakness in the hashing algorithm of the API authentication; The second regards debug settings being enabled by...

VxWorks weak wuthentication

Weak password hashing algorythm with large collision probability...

[R7-0035] VxWorks Authentication Library Weak Password Hashing

R7-0035: VxWorks Authentication Library Weak Password Hashing August 2, 2010 -- Vulnerability Details: This vulnerability allows remote attackers to bypass the authentication process for the Telnet and FTP services of the VxWorks operating system. This flaw occurs due to an insecure password...

Wind River Systems VxWorks weak default hashing algorithm in standard authentication API (loginLib)

Overview The hashing algorithm that is used in the standard authentication API for VxWorks is susceptible to collisions. An attacker can brute force a password by guessing a string that produces the same hash as a legitimate password. Description An attacker with a known username and access to a...

Advisory: jBCrypt < 0.3 character encoding vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 jBCrypt security advisory ========================= jBCrypt is a Java implementation of OpenBSD's Blowfish password hashing algorithm, as described in "A Future-Adaptable Password Scheme" by Niels Provos and David Mazieres USENIX, 1999. Versions of...

CVE-2009-4304

Moodle 1.8 before 1.8.11 and 1.9 before 1.9.7 does not use a random password salt in config.php, which makes it easier for attackers to conduct brute-force password guessing attacks...

Fedora Core 11 FEDORA-2009-10329 (python-markdown2)

The remote host is missing an update to python-markdown2 announced via advisory FEDORA-2009-10329. Note: This VT has been deprecated and is therefore no longer functional. SPDX-FileCopyrightText: 2009 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyrig...

Fedora 11 : python-markdown2-1.0.1.15-1.fc11 (2009-10329)

Update from 1.0.1.11 to 1.0.1.15, which fixes some issues, including these two security-related bugs: - Issue 30 Fix a possible XSS via JavaScript injection in a carefully crafted image reference usage of double-quotes in the URL. - Issue 29 Fix security hole in the md5-hashing scheme for handlin...

Fedora 10 : python-markdown2-1.0.1.15-1.fc10 (2009-10377)

Update from 1.0.1.11 to 1.0.1.15, which fixes some issues, including these two security-related bugs: - Issue 30 Fix a possible XSS via JavaScript injection in a carefully crafted image reference usage of double-quotes in the URL. - Issue 29 Fix security hole in the md5-hashing scheme for handlin...

Stable Update: Security fixes

Google Chrome 2.0.172.43 has been released to the Stable channel to fix the security issues listed below. CVE-2009- 2935 Unauthorized memory read from Javascript A flaw in the V8 Javascript engine might allow specially-crafted Javascript on a web page to read unauthorized memory, bypassing securi...

Nate Lawson: Crypto Strikes Back!

This Google Tech Talk features researcher Nate Lawson discussing recent vulnerabilities in crypto libraries, why public key cryptography is like a Ford Pinto in a demolition derby and the password-hashing mess created by Web 2.0 sites...