CVE-2014-9251

Zenoss Core through 5 Beta 3 uses a weak algorithm to hash passwords, which makes it easier for context-dependent attackers to obtain cleartext values via a brute-force attack on hash values in the database, aka ZEN-15413...

CVE-2014-9251

Zenoss Core up to 5 Beta 3 uses a weak password-hashing algorithm, enabling context-dependent attackers to obtain plaintext passwords by brute-forcing stored hashes in the database (ZEN-15413). CVSS v2 base score 5.0 (Medium) as per NVD.

Zenoss < 4.2.5 Multiple Vulnerabilities

Binary data 8594.prm...

Drupal Password Hashing Denial of Service Vulnerability

A vulnerability in the password hashing API of Drupal 7 can lead to a DoS. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Updated drupal packages fix security vulnerabilities

Updated drupal packages fix security vulnerability: Aaron Averill discovered that a specially crafted request can give a user access to another user's session, allowing an attacker to hijack a random session CVE-2014-9015. Michael Cullum, Javier Nieto and Andres Rojas Guerrero discovered that the...

CVE-2014-9034

wp-includes/class-phpass.php in WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 allows remote attackers to cause a denial of service CPU consumption via a long password that is improperly handled during hashing, a similar issue to CVE-2014-9016...

UBUNTU-CVE-2014-9016

The password hashing API in Drupal 7.x before 7.34 and the Secure Password Hashes aka phpass module 6.x-2.x before 6.x-2.1 for Drupal allows remote attackers to cause a denial of service CPU and memory consumption via a crafted request...

Cross site request forgery (csrf)

The password hashing API in Drupal 7.x before 7.34 and the Secure Password Hashes aka phpass module 6.x-2.x before 6.x-2.1 for Drupal allows remote attackers to cause a denial of service CPU and memory consumption via a crafted request...

CVE-2014-9016

The password hashing API in Drupal 7.x before 7.34 and the Secure Password Hashes aka phpass module 6.x-2.x before 6.x-2.1 for Drupal allows remote attackers to cause a denial of service CPU and memory consumption via a crafted request...

CVE-2014-9016

CVE-2014-9016 affects Drupal 7.x prior to 7.34 and the Secure Password Hashes (phpass) module 6.x-2.x prior to 6.x-2.1. The issue is a denial-of-service condition caused by the password hashing API, where a crafted request can exhaust CPU and memory. Remediation is to update to Drupal 7.34+ and p...

CVE-2014-9016

Removed by vendor...

Drupal 6.x < 6.34 / 7.x < 7.34 Multiple Vulnerabilities

The remote web server is running a version of Drupal that is 6.x prior to 6.34 or 7.x prior to 7.34. It is, therefore, potentially affected by the following vulnerabilities : - There exists an unspecified flaw that is triggered when handling a specially crafted request that may allow a remote...

Debian DSA-3075-1 : drupal7 - security update

Two vulnerabilities were discovered in Drupal, a fully-featured content management framework. The Common Vulnerabilities and Exposures project identifies the following issues : - CVE-2014-9015 Aaron Averill discovered that a specially crafted request can give a user access to another user's...

drupal: session hijacking and denial of service

Custom configured session.inc and password.inc need to be audited as well to verify if they are prone to the following vulnerabilities. More information can be found in the upstream advisory 0. - CVE-2014-9015 session hijacking Aaron Averill discovered that a specially crafted request can give a...

Debian Security Advisory DSA 3075-1 (drupal7 - security update)

Two vulnerabilities were discovered in Drupal, a fully-featured content management framework. The Common Vulnerabilities and Exposures project identifies the following issues: CVE-2014-9015 Aaron Averill discovered that a specially crafted request can give a user access to another user OpenVAS...

DSA-3075-1 drupal7 - security update

Bulletin has no description...

Mozilla MDN Password Disclosure Affects 76,000 Developers

Some members of the Mozilla Developer Network are being advised to change their passwords after email addresses and encrypted credentials were disclosed on a public server. Mozilla director of developer relations Stormy Peters said the organization has been investigating the disclosure for 10 day...

RHEL 6 : MRG (RHSA-2014:0440)

Updated Grid component packages that fix two security issues, multiple bugs, and provide several enhancements are now available for Red Hat Enterprise MRG 2.5 for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having Moderate security impact. Common...

MoME CMS <= 0.8.5 - Remote Login Bypass Exploit

No description provided by source. '/ -.- --------------------oOO------OOo------------------- | MoME CMS = 0.8.5 Remote Login Bypass Exploit | | works only with magicquotesgpc = off | ------------------------------------------------------ ! Discovered: cr4wl3r cr4wl3r!linuxmail.org ! Download:...

Simple HRM System <= 2.3 - Multiple Vulnerabilities

No description provided by source. Exploit Title: Multiple Vulnerabilities in Simple HRM system v2.3 and below Date: 12/04/2013 Exploit Author: Doraemon Vendor Homepage: http://www.simplehrm.com/ Software Link: http://sourceforge.net/projects/simplehrm/ Version: 2.2/2.3 Tested on: 2.2 & 2.3 CVE :...