42 matches found
Euros Football Fever Nets Dumb Passwords
The European soccer championship a.k.a. the Euros is stoking maximum football fever, which has slopped over into easy-to-crack passwords. Such as, say, “football.” That password is of course easy as pie to crack via a dictionary attack – a type of brute-force attack that involves trying thousands...
Insecure Cryptography
rclone is vulnerable to insecure cryptography. The vulnerability exists due to the use of an insecure random number generator which produces insecure passwords with much less entropy than advertised...
CVE-2019-19093
eSOMS versions 4.0 to 6.0.3 do not enforce password complexity settings, potentially resulting in lower access security due to insecure user passwords...
CVE-2019-19093
eSOMS versions 4.0 to 6.0.3 do not enforce password complexity settings, potentially resulting in lower access security due to insecure user passwords...
CVE-2010-2247
makepasswd 1.10 default settings generate insecure passwords...
DEBIAN-CVE-2010-2247
makepasswd 1.10 default settings generate insecure passwords...
Default configuration
makepasswd 1.10 default settings generate insecure passwords...
PT-2019-6538 · Unknown · Makepasswd
Name of the Vulnerable Software and Affected Versions: makepasswd version 1.10 Description: The default settings of makepasswd 1.10 generate insecure passwords. Recommendations: For makepasswd version 1.10, consider changing the default settings to generate more secure passwords. As a temporary...
Design/Logic Flaw
In SolarWinds SFTP/SCP Server through 2018-09-10, the configuration file is world readable and writable, and stores user passwords in an insecure manner, allowing an attacker to determine passwords for potentially privileged accounts. This also grants the attacker an ability to backdoor the serve...
Microsoft Windows Elevation of Privilege Vulnerability (CNVD-2018-05739 )
Microsoft Windows 10 and Windows Server 2016 are both products of Microsoft Corporation USA. The former is a set of operating systems for personal computers and the latter is a server operating system. A privilege-lifting vulnerability exists in Microsoft Windows 10 version 1607 and Windows Serve...
The vulnerability of the microprogrammed logic controllers Micrologix 1100 and Micrologix 1400, which stems from the use of insufficiently secure passwords, allows attackers to circumvent security restrictions.
The vulnerability of the microprogrammed logic controllers Micrologix 1100 and Micrologix 1400 is related to the use of passwords that are not sufficiently secure the use of numeric passwords with a limited maximum number of characters. Exploiting this vulnerability can allow an attacker operatin...
CVE-2015-8542
An issue was discovered in Open-Xchange Guard before 2.2.0-rev8. The "getprivkeybyid" API call is used to download a PGP Private Key for a specific user after providing authentication credentials. Clients provide the "id" and "cid" parameter to specify the current user by its user- and context-ID...
CVE-2010-5307
The HIPAA configuration interface in GE Healthcare Optima MR360 has a password of 1 operator for the root account, 2 adw2.0 for the admin account, and 3 adw2.0 for the sdc account, which has unspecified impact and attack vectors. NOTE: it is not clear whether these passwords are default, hardcode...
CVE-2015-1455
Fortinet FortiAuthenticator 3.0.0 has a password of 1 slony for the slony PostgreSQL user and 2 www-data for the www-data PostgreSQL user, which makes it easier for remote attackers to obtain access via unspecified vectors...
Password Security Do's and Don'ts
We write a lot about sophisticated, targeted attacks and zero day vulnerabilities aside. But the fact is that most security breaches hinge on easy to prevent security holes – such as insecure passwords. Indeed, even as headlines blare about data breaches and hacks at prominent firms, password...
CVE-2009-0919
XAMPP installs multiple packages with insecure default passwords, which makes it easier for remote attackers to obtain access via 1 the "lampp" default password for the "nobody" account within the included ProFTPD installation, 2 a blank default password for the "root" account within the included...
CVE-2009-0919
The CVE-2009-0919 entry describes insecure default credentials in XAMPP bundles, enabling remote access through (1) lampp/default password for the nobody account in ProFTPD, (2) a blank root password in the included MySQL installation, and (3) a blank pma password in phpMyAdmin, among potentially...
CVE-2009-0919
XAMPP installs multiple packages with insecure default passwords, which makes it easier for remote attackers to obtain access via 1 the "lampp" default password for the "nobody" account within the included ProFTPD installation, 2 a blank default password for the "root" account within the included...
CVE-2006-5474
The "forgot password" function in OneOrZero Helpdesk before 1.6.5.4 generates insecure passwords by concatenating the current timestamp with the username, which allows remote attackers to gain access as an arbitrary user by requesting a password reset...
CVE-2006-5474
The "forgot password" function in OneOrZero Helpdesk before 1.6.5.4 generates insecure passwords by concatenating the current timestamp with the username, which allows remote attackers to gain access as an arbitrary user by requesting a password reset...