CVE-2013-4577

A certain Debian patch for GNU GRUB uses world-readable permissions for grub.cfg, which allows local users to obtain password hashes, as demonstrated by reading the passwordpbkdf2 directive in the file...

PT-2015-13: Unauthorized Access in Siemens SIMATIC HMI Devices

The specialists of the Positive Research center have detected a Unauthorized Access vulnerability in Siemens SIMATIC HMI Devices. The vulnerability allows remote attackers to obtain password hashes for SIMATIC WinCC users and complete authentication. How to fix Update your sofware up to the lates...

CVE-2014-0645

EMC Cloud Tiering Appliance CTA 9.x through 10 SP1 and File Management Appliance FMA 7.x store DES password hashes for the root, super, and admin accounts, which makes it easier for context-dependent attackers to obtain sensitive information via a brute-force attack...

Information disclosure

EMC Cloud Tiering Appliance CTA 9.x through 10 SP1 and File Management Appliance FMA 7.x store DES password hashes for the root, super, and admin accounts, which makes it easier for context-dependent attackers to obtain sensitive information via a brute-force attack...

CVE-2014-0645

EMC Cloud Tiering Appliance CTA 9.x through 10 SP1 and File Management Appliance FMA 7.x store DES password hashes for the root, super, and admin accounts, which makes it easier for context-dependent attackers to obtain sensitive information via a brute-force attack...

CVE-2014-0645

EMC Cloud Tiering Appliance (CTA) versions 9.x–10 SP1 and Cloud Tiering Appliance (CTA) 10.x/10 SP1 Vulnerabilities: two issues are described. First, CVE-2014-0645: default root/super/admin passwords are DES-encrypted and stored, enabling context-dependent attackers to brute-force sensitive data ...

Automated NoSQL Database Injection Attacks: NoSQLMap

NoSQLMap is an open source Python tool designed to audit for as well as automate injection attacks and exploit default configuration weaknesses in NoSQL databases as well as web applications using NoSQL in order to disclose data from the database. It is named as a tribute to Bernardo Damele and...

CVE-2013-7247

cgi-bin/tsaws.cgi in Franklin Fueling Systems TS-550 evo with firmware 2.0.0.6833 and other versions before 2.4.0 allows remote attackers to discover sensitive information user names and password hashes via the cmdWebGetConfiguration action in a TSAREQUEST...

Design/Logic Flaw

cgi-bin/tsaws.cgi in Franklin Fueling Systems TS-550 evo with firmware 2.0.0.6833 and other versions before 2.4.0 allows remote attackers to discover sensitive information user names and password hashes via the cmdWebGetConfiguration action in a TSAREQUEST...

CVE-2013-7247

The CVE-2013-7247 issue affects Franklin Fueling Systems TS-550 evo devices (firmware

CVE-2013-7247

cgi-bin/tsaws.cgi in Franklin Fueling Systems TS-550 evo with firmware 2.0.0.6833 and other versions before 2.4.0 allows remote attackers to discover sensitive information user names and password hashes via the cmdWebGetConfiguration action in a TSAREQUEST...

[Hasher v1.0.3] Python tool to locally generate / compare password hashes

Hasher is a tool designed to quickly generate hashes from a plaintext string in a variety of hash formats. It also can quickly compare a plaintext string to a hash value of a specific hash type to determine if they are a match. Hasher was designed to be a way to locally generate or compare passwo...

CVE-2013-6953

BlogEngine.NET 2.8.0.0 and earlier allows remote attackers to read usernames and password hashes via a request for the sioc.axd file...

Default credentials

BlogEngine.NET 2.8.0.0 and earlier allows remote attackers to read usernames and password hashes via a request for the sioc.axd file...

CVE-2013-6953

Summary of CVE-2013-6953 : BlogEngine.NET 2.8.0.0 and earlier contains an information disclosure vulnerability that allows a remote attacker to read usernames and password hashes by requesting the sioc.axd file. The issue is caused by access to sioc.axd revealing credential information. Public so...

CVE-2013-6953

BlogEngine.NET 2.8.0.0 and earlier allows remote attackers to read usernames and password hashes via a request for the sioc.axd file...

[HashTag] Password Hash Type Identification (Identify Hashes)

HashTag.py is a Python script written to parse and identify the password hash type used. HashTag supports the identification of over 250 hash types along with matching them to over 110 hashcat modes use the command line switch -hc to output the hashcat modes. It is also able to identify a single...

CVE-2013-5097

Juniper Junos Space before 13.1R1.6, as used on the JA1500 appliance and in other contexts, does not properly restrict access to the list of user accounts and their MD5 password hashes, which makes it easier for remote authenticated users to obtain sensitive information via a dictionary attack, a...

Design/Logic Flaw

Juniper Junos Space before 13.1R1.6, as used on the JA1500 appliance and in other contexts, does not properly restrict access to the list of user accounts and their MD5 password hashes, which makes it easier for remote authenticated users to obtain sensitive information via a dictionary attack, a...

sosreport does not blank root password in anaconda plugin

The sosreport utility in the Red Hat sos package before 2.2-29 does not remove the root user password information from the Kickstart configuration file /root/anaconda-ks.cfg when creating an archive of debugging information, which might allow attackers to obtain passwords or password hashes...