82 matches found
Timing Attack
passport-local-mongoose is vulnerable to timing attack. The attack exists because password comparison function does not use a secure constant time comparison, allowing the attacker to guess the password...
Timing Attack
BCrypt.Net-Core is vulnerable to timing attacks. The library does not compare the password hash in constant time, allowing a malicious user to use the timing of the request to progressively identify a valid hash...
Remote Security Bypass
libcurl.so is vulnerable to remote security bypass attacks. The vulnerability exists due to a flaw of case insensitive password comparisons such that an attacker with the correct case insensitive password would be authorized...
phpLiteAdmin 1.9.7.1 Authorization Bypass Vulnerability
Exploit for php platform in category web applications I found a small issue in PHPLiteAdmin. It's an authorization bypass which works since version 1.9.5 from 2014 current is 1.9.7.1 because PLA uses '==' instead of '===' for the password comparison in 'attemptGrant' of the 'Authorization' class...
Icinga Password Disclosure Vulnerability
Icinga is an open source computer system and network monitoring application. Icinga suffers from a password disclosure vulnerability. The vulnerability arises due to the lack of a constant time password comparison feature. An attacker can exploit this vulnerability to obtain a password...
Default credentials
An issue was discovered in Icinga 2.x through 2.8.1. The lack of a constant-time password comparison function can disclose the password to an attacker...
CVE-2018-6535
An issue was discovered in Icinga 2.x through 2.8.1. The lack of a constant-time password comparison function can disclose the password to an attacker...
Timing Attack
stripeevent is vulnerable to timing attacks. It does not do password comparison in constant time, because it uses a non-constant character to character comparison. Attackers can exploit this difference to perform a timing attack, essentially allowing them to guess the password one character at a...
Timing Attack
github.com/hashicorp/vault is vulnerable to timing attacks. This vulnerability is caused because passwords are not compared in constant time, allowing malicious users to guess valid passwords based on the time that a comparison takes...
Timing Attack
radicale is vulnerable to timing attacks. It does not compare passwords in constant time, because it uses a non-constant character to character comparison. Consequently, the comparison will fail faster when the first characters in the password are incorrect. Attackers can exploit this difference ...
Medium: curl
Issue Overview: This build resolves the following issues: CVE-2016-8615: Cookie injection for other servers CVE-2016-8616: Case insensitive password comparison CVE-2016-8617: Out-of-bounds write via unchecked multiplication CVE-2016-8618: Double-free in curlmaprintf CVE-2016-8619: Double-free in...
SUSE-SU-2016:2714-1 Security update for curl
This update for curl fixes the following security issues: - CVE-2016-8624: invalid URL parsing with '' bsc1005646 - CVE-2016-8623: Use-after-free via shared cookies bsc1005645 - CVE-2016-8621: curlgetdate read out of bounds bsc1005642 - CVE-2016-8619: double-free in krb5 code bsc1005638 -...
CVE-2016-8616
A flaw was found in curl before version 7.51.0 When re-using a connection, curl was doing case insensitive comparisons of user name and password with the existing connections. This means that if an unused connection with proper credentials exists for a protocol that has connection-scoped...
cURL -- multiple vulnerabilities
The cURL project reports cookie injection for other servers case insensitive password comparison OOB write via unchecked multiplication double-free in curlmaprintf double-free in krb5 code glob parser write/read out of bounds curlgetdate read out of bounds URL unescape heap overflow via integer...
Security fix for the ALT Linux 8 package curl version 7.51.0-alt1
Nov. 2, 2016 Anton Farygin 7.51.0-alt1 - new version with security fixes: CVE-2016-8615: cookie injection for other servers CVE-2016-8616: case insensitive password comparison CVE-2016-8617: OOB write via unchecked multiplication CVE-2016-8618: double-free in curlmaprintf CVE-2016-8619: double-fr...
Kaspersky Total Security 15.0.1.415 Authentication Bypass Vulnerability
By analyzing the password-based authentication for unloading the Kaspersky Total Security protection, the SySS GmbH found out, that the password comparison is done within the process avp.exe actually within the used module shellservice.dll, which runs or can be run in the context of the current...
Kaspersky Small Office Security 13.0.4.233 Authentication Bypass Vulnerability
By analyzing the password-based authentication for unloading the Kaspersky Small Office Security protection, the SySS GmbH found out, that the password comparison is done within the process avp.exe actually within the module avpmain.dll, which runs or can be run in the context of the current...
Medium: pam
Issue Overview: Multiple directory traversal vulnerabilities in pamtimestamp.c in the pamtimestamp module for Linux-PAM aka pam 1.1.8 allow local users to create aribitrary files or possibly bypass authentication via a .. dot dot in the 1 PAMRUSER value to the getruser function or 2 PAMTTY value ...
