CVE-2010-5066

The createRandomPassword function in includes/functionscommon.php in Virtual War aka VWar 1.6.1 R2 uses a small range of values to select the seed argument for the PHP mtsrand function, which makes it easier for remote attackers to determine randomly generated passwords via a brute-force attack...

CoSoSys Endpoint Protector - Predictable Password Generation

CoSoSys Endpoint Protector - Predictable Password Generation source: https://www.securityfocus.com/bid/55570/info CoSoSys Endpoint Protector is prone to an insecure password generation vulnerability. Successfully exploiting this issue may allow an attacker to guess generated passwords and gain...

CoSoSys Endpoint Protector - Predictable Password Generation

source: https://www.securityfocus.com/bid/55570/info CoSoSys Endpoint Protector is prone to an insecure password generation vulnerability. Successfully exploiting this issue may allow an attacker to guess generated passwords and gain access to affected appliances. CoSoSys Endpoint Protector 4 is...

SDCMS 1. 1sp1 the XSS vulnerability of the mining and use-vulnerability and early warning-the black bar safety net

SDCMS 1. 1sp1XSSthe vulnerability of the mining and use of SDCMS name: era website Information Management System. SDCMS is based on ASP+ACCESS/MSSQL website Information Management System. Permanently free, open source! SDCMS to information as the theme, through text and image title as a starting...

Joomla! 1.5.x可预测密码生成和信息泄露漏洞

Bugtraq ID: 52750 Joomla!是基于php+mysql模式的快速建站系统 Joomla!存在安全漏洞，允许攻击者获得敏感信息或绕过安全限制 -密码生成算法存在错误可生成可猜测密码，通过密码重置功能可猜测生成的密码信息。 -存在一个不充分权限检查错误，可被利用获得管理员后端的部分敏感信息 0 Joomla! 1.5.x 厂商解决方案 Joomla! 1.5.26已经修复此漏洞，建议用户下载使用： http://www.joomla.org/...

Pro Clan Manager 1.4.2 SQL Injection

Pro Clan Manager, Multiple Vulnerabilities =============== Document Details =============== Version 1.0, 2011-11-19 =============== Background =============== "The aim of Pro Clan Manager is to create an international content management system dedicated to helping Clans or Guilds work together an...

Dienstplan Predictable Random Password Generation Vulnerability

Dienstplan is prone to an insecure random password generation vulnerability. Successfully exploiting this issue may allow an attacker to guess randomly generated passwords. Versions prior to Dienstplan 2.3 are vulnerable. OpenVAS Vulnerability Test $Id: gbdienstplan49412.nasl 5747 2017-03-28...

Dienstplan Predictable Random Password Generation Vulnerability

Dienstplan is prone to an insecure random password generation vulnerability. Successfully exploiting this issue may allow an attacker to guess randomly generated passwords. Versions prior to Dienstplan 2.3 are vulnerable. SPDX-FileCopyrightText: 2011 Greenbone AG Some text descriptions might be...

Hydra v6.2 with a password bruteforcing mode, xmpp and irc modules, MD5/SHA1/ Support !

Hydra v6.2 with a password bruteforcing mode, xmpp and irc modules, MD5/SHA1/ Support ! A very fast network logon cracker which support many different services. Have a look at the feature sets and services coverage page - including a speed comparison against ncrack and medusa! CHANGELOG for 6.2...

Fedora 9 : phpMyAdmin-3.2.0.1-1.fc9 (2009-7337)

The first security release for phpMyAdmin 3.2.0: - security XSS: Insufficient output sanitizing in bookmarks This version contains a number of small new features and some bug fixes: - core better support for vendor customisation based on what Debian needs - rfe warn when session.gcmaxlifetime is...

FreeBSD Ports: mailman, ja-mailman

The remote host is missing an update to the system as announced in the referenced advisory. VID b3cd00f7-c0c5-452d-87bc-086c5635333e OpenVAS Vulnerability Test $ Description: Auto generated from vuxml or freebsd advisories Authors: Thomas Reinke Copyright: Copyright c 2008 E-Soft Inc...

FreeBSD Ports: mailman, ja-mailman

The remote host is missing an update to the system as announced in the referenced advisory. SPDX-FileCopyrightText: 2008 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

Daily web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)

PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc. Wordpress: different message for wrong username and pasword, weak inicial password generation...

PT-2008-1794 · Webportal · Webportal Cms

Name of the Vulnerable Software and Affected Versions: WebPortal CMS version 0.6-beta Description: The issue allows remote attackers to obtain access to any account via a lostpass action because the actions.php file in WebPortal CMS generates predictable passwords containing only the time of day...

OneOrZero Helpdesk以不安全方式生成口令漏洞

OneOrZero Helpdesk是一个PHP/MySQL帮助桌面软件。 OneOrZero生成访问口令的方式上存在漏洞，攻击者可以利用此漏洞推测出自动生成的口令。 OneOrZero的forgot password函数会在回答完安全问题后重置口令，默认下这个口令为空。用户可以通过重置管理员口令并保持回答为空强制重置口令。但是，由于口令重置函数是基于用户名和服务器时间来设置口令的，因此可以通过服务器的时间来判断所设置的口令。 OneOrZero OneOrZero 1.6.0 - 1.6.4 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：...

Design/Logic Flaw

BusyBox 1.1.1 does not use a salt when generating passwords, which makes it easier for local users to guess passwords from a stolen password file using techniques such as rainbow tables...

CVE-2006-1058

BusyBox 1.1.1 does not use a salt when generating passwords, which makes it easier for local users to guess passwords from a stolen password file using techniques such as rainbow tables...

CVE-2004-1143

The CVE-2004-1143 issue concerns Mailman prior to version 2.1.5, where auto-generated passwords are limited to about 5 million, enabling remote attackers to perform brute-force guessing of subscriber credentials. Remediation: upgrade to Mailman 2.1.5 or newer (as detailed in related advisories). ...

CVE-2004-1143

The password generation in mailman before 2.1.5 generates only 5 million unique passwords, which makes it easier for remote attackers to guess passwords via a brute force attack...

USN-59-1: mailman vulnerabilities

Florian Weimer discovered a cross-site scripting vulnerability in mailman's automatically generated error messages. An attacker could craft an URL containing JavaScript or other content embedded into HTML which triggered a mailman error page. When an unsuspecting user followed this URL, the...