CVE-2019-5021: Empty Password in Configuration File

Versions of the Official Alpine Linux Docker images since v3.3 contain a NULL password for the root user. This vulnerability appears to be the result of a regression introduced in December of 2015. Due to the nature of this issue, systems deployed using affected versions of the Alpine Linux...

Alpine Linux Docker Image root User Hard-Coded Credential Vulnerability

Summary Versions of the Official Alpine Linux Docker images since v3.3 contain a NULL password for the root user. This vulnerability appears to be the result of a regression introduced in December t2015. Due to the nature of this issue, systems deployed using affected versions of the Alpine Linux...

Symfony Authentication Bypass Vulnerability

Sensio Labs Symfony is a French company Sensio Labs set of free , MVC-based PHP development framework , which provides commonly used functional components and tools , can be used to quickly create complex WEB programs . Ldap component is a lightweight directory access protocol component . A...

DEBIAN-CVE-2018-11407

An issue was discovered in the Ldap component in Symfony 2.8.x before 2.8.37, 3.3.x before 3.3.17, 3.4.x before 3.4.7, and 4.0.x before 4.0.7. It allows remote attackers to bypass authentication by logging in with a "null" password and valid username, which triggers an unauthenticated bind. NOTE:...

UBUNTU-CVE-2018-11407

An issue was discovered in the Ldap component in Symfony 2.8.x before 2.8.37, 3.3.x before 3.3.17, 3.4.x before 3.4.7, and 4.0.x before 4.0.7. It allows remote attackers to bypass authentication by logging in with a "null" password and valid username, which triggers an unauthenticated bind. NOTE:...

CVE-2018-11407: Improper Authentication

An issue was discovered in the Ldap component in Symfony 2.8.x before 2.8.37, 3.3.x before 3.3.17, 3.4.x before 3.4.7, and 4.0.x before 4.0.7. It allows remote attackers to bypass authentication by logging in with a "null" password and valid username, which triggers an unauthenticated bind. NOTE:...

PT-2018-10551

Name of the Vulnerable Software and Affected Versions Symfony versions 2.8.x through 2.8.36 Symfony versions 3.3.x through 3.3.16 Symfony versions 3.4.x through 3.4.6 Symfony versions 4.0.x through 4.0.6 Description An issue in the Ldap component allows remote attackers to bypass authentication b...

Cisco Elastic Services Controller Authentication Bypass Privilege Escalation

The vulnerability of the authentication function of the Cisco Elastic Services Controller ESC web portal for virtualizing network functions is related to deficiencies in the authentication process. Exploiting this vulnerability could allow a malicious actor to bypass the authentication process an...

go-ldap ldap trust management vulnerability

go-ldap ldap is a GO language based LDAP server. A trust management vulnerability exists in go-ldap ldap version 2.5.0 and earlier. A remote attacker can exploit this vulnerability by logging into the server with the help of a null password...

PostgreSQL Security Bypass Vulnerability (CNVD-2017-26577)

PostgreSQL is a free object-relational database management system developed by the PostgreSQL development group. The system supports most of the SQL standards and provides many other features, such as foreign keys, triggers, views, and so on. A security bypass vulnerability exists in PostgreSQL. ...

Weblate: Null Password - Setting a new password doesn't check for empty spaces

Hi Again! As seen your website at https://demo.weblate.org/accounts/password/ Your password can't be too similar to your other personal information. Your password must contain at least 6 characters. Your password can't be a commonly used password. Your password can't be entirely numeric. I found...

Shenzhen Haixilian's WIFICAM webcam suffers from null password vulnerability

Shenzhen Haixilian Technology Co., Ltd. is a comprehensive technology enterprise integrating R&D, production, sales and service.WIFICAM camera is one of the webcam products of the company. A null password vulnerability exists in Shenzhen Haixilian's WIFICAM webcam. Because WIFICAM webcam uses por...

VulnCheck KEV: CVE-1999-0502

A Unix account has a default, null, blank, or missing password...

Null Password Vulnerability in Nport 5110 Devices of Mosaic Technology (Shanghai) Co.

The MOXA Nport 5110 is a serial communication server. A null password vulnerability exists in the MOXA Nport 5110 device, which allows an attacker to exploit the vulnerability to log in to the system backend, gain administrator privileges, and obtain sensitive information about the device...

Edimax PS-1206MF - Web Admin Auth Bypass Vulnerability

Exploit for hardware platform in category web applications Title: Edimax PS-1206MF - Web Admin Auth Bypass Date: 30.08.15 Vendor: edimax.com Firmware version: 4.8.25 Author: Smash Contact: smash at devilteam.pl HTTP authorization is not being properly verified while sendind POST requests to .cgi,...

MDaemon SMTP Server 5.0.5 Null Password Authentication Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/8382/info A vulnerability has been reported to affect the MDaemon SMTP authentication handler. It has been reported that any valid username or account can be used in conjunction with a null password, to access the MDaemon...

UBUNTU-CVE-2013-0191

libpam-pgsql aka pampgsql 0.7 does not properly handle a NULL value returned by the password search query, which allows remote attackers to bypass authentication via a crafted password...

JBoss: CallerIdentityLoginModule retaining password from previous call if a null password is provided

The CallerIdentityLoginModule in JBoss Enterprise Application Platform EAP before 5.2.0, Web Platform EWP before 5.2.0, BRMS Platform before 5.3.1, and SOA Platform before 5.3.1 allows remote attackers to gain privileges of the previous user via a null password, which causes the previous user's...

CVE-2012-3369

The CallerIdentityLoginModule in JBoss Enterprise Application Platform EAP before 5.2.0, Web Platform EWP before 5.2.0, BRMS Platform before 5.3.1, and SOA Platform before 5.3.1 allows remote attackers to gain privileges of the previous user via a null password, which causes the previous user's...

CVE-2012-3369

The CallerIdentityLoginModule in JBoss Enterprise Application Platform EAP before 5.2.0, Web Platform EWP before 5.2.0, BRMS Platform before 5.3.1, and SOA Platform before 5.3.1 allows remote attackers to gain privileges of the previous user via a null password, which causes the previous user's...