244 matches found
Joomla! 1.5.x可预测密码生成和信息泄露漏洞
Bugtraq ID: 52750 Joomla!是基于php+mysql模式的快速建站系统 Joomla!存在安全漏洞，允许攻击者获得敏感信息或绕过安全限制 -密码生成算法存在错误可生成可猜测密码，通过密码重置功能可猜测生成的密码信息。 -存在一个不充分权限检查错误，可被利用获得管理员后端的部分敏感信息 0 Joomla! 1.5.x 厂商解决方案 Joomla! 1.5.26已经修复此漏洞，建议用户下载使用： http://www.joomla.org/...
Pro Clan Manager 1.4.2 SQL Injection
Pro Clan Manager, Multiple Vulnerabilities =============== Document Details =============== Version 1.0, 2011-11-19 =============== Background =============== "The aim of Pro Clan Manager is to create an international content management system dedicated to helping Clans or Guilds work together an...
Dienstplan Predictable Random Password Generation Vulnerability
Dienstplan is prone to an insecure random password generation vulnerability. Successfully exploiting this issue may allow an attacker to guess randomly generated passwords. Versions prior to Dienstplan 2.3 are vulnerable. OpenVAS Vulnerability Test $Id: gbdienstplan49412.nasl 5747 2017-03-28...
Dienstplan Predictable Random Password Generation Vulnerability
Dienstplan is prone to an insecure random password generation vulnerability. Successfully exploiting this issue may allow an attacker to guess randomly generated passwords. Versions prior to Dienstplan 2.3 are vulnerable. SPDX-FileCopyrightText: 2011 Greenbone AG Some text descriptions might be...
Hydra v6.2 with a password bruteforcing mode, xmpp and irc modules, MD5/SHA1/ Support !
Hydra v6.2 with a password bruteforcing mode, xmpp and irc modules, MD5/SHA1/ Support ! A very fast network logon cracker which support many different services. Have a look at the feature sets and services coverage page - including a speed comparison against ncrack and medusa! CHANGELOG for 6.2...
Fedora 9 : phpMyAdmin-3.2.0.1-1.fc9 (2009-7337)
The first security release for phpMyAdmin 3.2.0: - security XSS: Insufficient output sanitizing in bookmarks This version contains a number of small new features and some bug fixes: - core better support for vendor customisation based on what Debian needs - rfe warn when session.gcmaxlifetime is...
FreeBSD Ports: mailman, ja-mailman
The remote host is missing an update to the system as announced in the referenced advisory. SPDX-FileCopyrightText: 2008 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...
FreeBSD Ports: mailman, ja-mailman
The remote host is missing an update to the system as announced in the referenced advisory. VID b3cd00f7-c0c5-452d-87bc-086c5635333e OpenVAS Vulnerability Test $ Description: Auto generated from vuxml or freebsd advisories Authors: Thomas Reinke Copyright: Copyright c 2008 E-Soft Inc...
Daily web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)
PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc. Wordpress: different message for wrong username and pasword, weak inicial password generation...
PT-2008-1794 · Webportal · Webportal Cms
Name of the Vulnerable Software and Affected Versions: WebPortal CMS version 0.6-beta Description: The issue allows remote attackers to obtain access to any account via a lostpass action because the actions.php file in WebPortal CMS generates predictable passwords containing only the time of day...
OneOrZero Helpdesk以不安全方式生成口令漏洞
OneOrZero Helpdesk是一个PHP/MySQL帮助桌面软件。 OneOrZero生成访问口令的方式上存在漏洞，攻击者可以利用此漏洞推测出自动生成的口令。 OneOrZero的forgot password函数会在回答完安全问题后重置口令，默认下这个口令为空。用户可以通过重置管理员口令并保持回答为空强制重置口令。但是，由于口令重置函数是基于用户名和服务器时间来设置口令的，因此可以通过服务器的时间来判断所设置的口令。 OneOrZero OneOrZero 1.6.0 - 1.6.4 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：...
Design/Logic Flaw
BusyBox 1.1.1 does not use a salt when generating passwords, which makes it easier for local users to guess passwords from a stolen password file using techniques such as rainbow tables...
CVE-2006-1058
BusyBox 1.1.1 does not use a salt when generating passwords, which makes it easier for local users to guess passwords from a stolen password file using techniques such as rainbow tables...
CVE-2004-1143
The CVE-2004-1143 issue concerns Mailman prior to version 2.1.5, where auto-generated passwords are limited to about 5 million, enabling remote attackers to perform brute-force guessing of subscriber credentials. Remediation: upgrade to Mailman 2.1.5 or newer (as detailed in related advisories). ...
CVE-2004-1143
The password generation in mailman before 2.1.5 generates only 5 million unique passwords, which makes it easier for remote attackers to guess passwords via a brute force attack...
USN-59-1: mailman vulnerabilities
Florian Weimer discovered a cross-site scripting vulnerability in mailman's automatically generated error messages. An attacker could craft an URL containing JavaScript or other content embedded into HTML which triggered a mailman error page. When an unsuspecting user followed this URL, the...
CVE-2004-1143
The password generation in mailman before 2.1.5 generates only 5 million unique passwords, which makes it easier for remote attackers to guess passwords via a brute force attack...
mkpasswd uses weak random number generator
Overview Mkpasswd generates passwords that are insufficiently random. Description Mkpasswd is a password generation utility included with Red Hat Linux and possibly other Linux distributions. Mkpasswd generates passwords that are not sufficiently random, which may allow an attacker to predict...