bouncycastle: password bypass in OpenBSDBCrypt.checkPassword utility possible

A flaw was found in bouncycastle. The OpenBSDBCrypt.checkPassword utility method compared incorrect data when checking the password allowing incorrect passwords to indicate they were matching with previously hashed ones that were different. The highest threat from this vulnerability is to data...

bouncycastle: password bypass in OpenBSDBCrypt.checkPassword utility possible

A flaw was found in bouncycastle. The OpenBSDBCrypt.checkPassword utility method compared incorrect data when checking the password allowing incorrect passwords to indicate they were matching with previously hashed ones that were different. The highest threat from this vulnerability is to data...

bouncycastle: password bypass in OpenBSDBCrypt.checkPassword utility possible

A flaw was found in bouncycastle. The OpenBSDBCrypt.checkPassword utility method compared incorrect data when checking the password allowing incorrect passwords to indicate they were matching with previously hashed ones that were different. The highest threat from this vulnerability is to data...

[SECURITY] [DLA 2577-1] python-pysaml2 security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-2577-1 [email protected] https://www.debian.org/lts/security/ Abhijith PA February 26, 2021 https://wiki.debian.org/LTS -...

CVE-2020-10048

CVE-2020-10048 affects Siemens SIMATIC PCS 7 (All versions) and SIMATIC WinCC (all versions

SIMATIC PCS 7 和 SIMATIC WinCC 授权问题漏洞

Siemens SIMATIC WinCC is an automated data acquisition and monitoring SCADA system from Siemens, Germany. A security vulnerability exists in Siemens SIMATIC WinCC. The vulnerability is caused due to an insecure password authentication process, which can be exploited by an attacker to bypass the...

DEBIAN-CVE-2021-26117

The optional ActiveMQ LDAP login module can be configured to use anonymous access to the LDAP server. In this case, for Apache ActiveMQ Artemis prior to version 2.16.0 and Apache ActiveMQ prior to versions 5.16.1 and 5.15.14, the anonymous context is used to verify a valid users password in error...

UBUNTU-CVE-2021-26117

The optional ActiveMQ LDAP login module can be configured to use anonymous access to the LDAP server. In this case, for Apache ActiveMQ Artemis prior to version 2.16.0 and Apache ActiveMQ prior to versions 5.16.1 and 5.15.14, the anonymous context is used to verify a valid users password in error...

CVE-2020-23360

oscommerce v2.3.4.1 has a functional problem in user registration and password rechecking, where a non-identical password can bypass the checks in /catalog/admin/administrators.php and /catalog/passwordreset.php...

WeBid security breach

WeBid is an open source auction site building solution. A security vulnerability exists in WeBid 1.2.2, which stems from the fact that two different passwords can bypass the check...

Apache ActiveMQ 授权问题漏洞

Apache ActiveMQ is the United States Apache Apache Foundation of a set of open source messaging middleware , which supports Java messaging services , clustering , Spring Framework and so on. An authorization issue vulnerability exists in the Apache ActiveMQ LDAP login module, which stems from an...

PT-2020-17293 · Logmein · Logmein Lastpass Password Manager

Name of the Vulnerable Software and Affected Versions: LogMein LastPass Password Manager version 4.8.11.2403 Description: An issue was discovered in the LogMein LastPass Password Manager app for iOS, where the password authentication for unlocking can be bypassed by forcing the authentication...

Estil Hill Lock Password Manager Safe app Security Breach

Estil Hill Lock Password Manager Safe App For IOS is a software for centralized security management of device application passwords from the individual developer Estill Hill. A security vulnerability exists in the Estil Hill Lock Password Manager Safe app version 2.3 for ios, which stems from the...

Brute forcing device passwords

When working with IoT and embedded systems, brute-force password guessing attacks are an effective tool to gain access. Over the years, I’ve learned some tips and tricks to make these attacks more effective. What is brute forcing? Very simply, it’s guessing passwords so that you can find a valid...

CloudBees Jenkins Active Directory Plugin Authorization Issue Vulnerability (CNVD-2020-61923)

CloudBees Jenkins Hudson Labs is the United States CloudBees company's set of Java-based development of continuous integration tools . The product is mainly used to monitor the continuous software version release/testing projects and some timed tasks . Active Directory Plugin is used in which an...

ownCloud < 10.4 Access Control Vulnerability

ownCloud is prone to an access control vulnerability. SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:owncloud:owncloud";...

X (Formerly Twitter): Bypass Password Authentication to Update the Password

Summary: This additional security measure from twitter provides protection to the victim's account, considering that a victim's session may have been hijacked by a hacker, however, due to this additional layer of security Implemented by twitter the hacker would not be able to change the victim's...

Cisco Webex Training Input Validation Error Vulnerability

Cisco Webex Training is an online training solution. An input validation error vulnerability exists in Cisco Webex Training that originates from not properly validating input data, allowing remote attackers to join a password-protected session without providing the session password...

CVE-2020-15483

An issue was discovered on Nescomed Multipara Monitor M1000 devices. The physical UART debug port provides a shell, without requiring a password, with complete access...

CVE-2020-15892

An issue was discovered in apply.cgi on D-Link DAP-1520 devices before 1.10b04Beta02. Whenever a user performs a login action from the web interface, the request values are being forwarded to the ssi binary. On the login page, the web interface restricts the password input field to a fixed length...