Intelligent Platform Management Interface - Information Disclosure

source: https://www.securityfocus.com/bid/61076/info Intelligent Platform Management Interface is prone to an information-disclosure vulnerability. Attackers can exploit this issue to obtain sensitive information that may aid password guessing attacks. Intelligent Platform Management Interface 2....

Brother HL5370 Command Execution / Password Guessing

Tested on Brother HL5370 latest firmware so far, confirmed working against many others by Brother documentation From Brother .de website - http://qr.cx/zCt9 Syntax for PJL JOB command includes - "PASSWORD = password HL-1660e/2060/2400C/2400Ce/3400CN/1650/1670N/3260N/2460/7050/...

CVE-2012-3137

The authentication protocol in Oracle Database Server 10.2.0.3, 10.2.0.4, 10.2.0.5, 11.1.0.7, 11.2.0.2, and 11.2.0.3 allows remote attackers to obtain the session key and salt for arbitrary users, which leaks information about the cryptographic hash and makes it easier to conduct brute force...

Authentication flaw

The authentication protocol in Oracle Database Server 10.2.0.3, 10.2.0.4, 10.2.0.5, 11.1.0.7, 11.2.0.2, and 11.2.0.3 allows remote attackers to obtain the session key and salt for arbitrary users, which leaks information about the cryptographic hash and makes it easier to conduct brute force...

CVE-2012-3137

The authentication protocol in Oracle Database Server 10.2.0.3, 10.2.0.4, 10.2.0.5, 11.1.0.7, 11.2.0.2, and 11.2.0.3 allows remote attackers to obtain the session key and salt for arbitrary users, which leaks information about the cryptographic hash and makes it easier to conduct brute force...

CVE-2012-2743

Revelation 0.4.13-2 and earlier does not iterate through SHA hashing algorithms for AES encryption, which makes it easier for context-dependent attackers to guess passwords via a brute force attack...

UBUNTU-CVE-2012-2743

Revelation 0.4.13-2 and earlier does not iterate through SHA hashing algorithms for AES encryption, which makes it easier for context-dependent attackers to guess passwords via a brute force attack...

CVE-2012-2743

Revelation 0.4.13-2 and earlier does not iterate through SHA hashing algorithms for AES encryption, which can enable context-dependent attackers to guess passwords through brute force. Affected component/file: the password hashing/crypto path in Revelation; root cause is lack of SHA algorithm ite...

CVE-2012-3798

The Janrain Capture module 6.x-1.0 and 7.x-1.0 for Drupal, when creating a local user account, allows attackers to obtain part of the initial input used to generate passwords, which makes it easier to conduct brute force password guessing attacks...

Default credentials

The Janrain Capture module 6.x-1.0 and 7.x-1.0 for Drupal, when creating a local user account, allows attackers to obtain part of the initial input used to generate passwords, which makes it easier to conduct brute force password guessing attacks...

CVE-2012-3798

The Janrain Capture module 6.x-1.0 and 7.x-1.0 for Drupal, when creating a local user account, allows attackers to obtain part of the initial input used to generate passwords, which makes it easier to conduct brute force password guessing attacks...

CVE-2012-3798

The CVE-2012-3798 issue affects the Janrain Capture module for Drupal (versions 6.x-1.0 and 7.x-1.0). During local user account creation, part of the initial input used to generate passwords is exposed, which can simplify brute-force password guessing attacks. Exploitation details, specific vulne...

http-proxy-brute NSE Script

Performs brute force password guessing against HTTP proxy servers. Script Arguments http-proxy-brute.url sets an alternative URL to use when brute forcing default: http-proxy-brute.method changes the HTTP method to use when performing brute force guessing default: HEAD creds.service, creds.global...

metasploit-xmlrpc-brute NSE Script

Performs brute force password auditing against a Metasploit RPC server using the XMLRPC protocol. Script Arguments passdb, unpwdb.passlimit, unpwdb.timelimit, unpwdb.userlimit, userdb See the documentation for the unpwdb library. creds.service, creds.global See the documentation for the creds...

openEngine 2.0 Multiple Blind SQL Injection vulnerabilities

Exploit for php platform in category web applications Author: Stefan Schurtz Affected Software: Successfully tested on openEngine 2.0 100226 Vendor URL: http://www.openengine.de/ Vendor Status: informed CVE-ID: - ========================== Vulnerability Description: ========================== The...

openEngine 2.0 Blind SQL Injection

Advisory: openEngine 2.0 'id' Blind SQL Injection vulnerability Advisory ID: SSCHADV2011-019 Author: Stefan Schurtz Affected Software: Successfully tested on openEngine 2.0 100226 Vendor URL: http://www.openengine.de/ Vendor Status: informed CVE-ID: - ========================== Vulnerability...

cvs-brute-repository NSE Script

Attempts to guess the name of the CVS repositories hosted on the remote server. With knowledge of the correct repository name, usernames and passwords can be guessed. Script Arguments cvs-brute-repository.repofile a file containing a list of repositories to guess cvs-brute-repository.nodefault wh...

Analysis of the postgresql database attack techniques II-vulnerability warning-the black bar safety net

You can see we broke up in a field for the name, then we continue incrementing the offset value, to obtain the other field, as shown in Figure 9 and 1=2 union select 1,columnname,'3','4' from informationschema. the columns where tablename='admins' offset 2 limit 1-- ! Figure 9 Field passowrd is...

Nmap NSE net: mysql-brute

Performs password guessing against MySQL SYNTAX: userdb: The filename of an alternate username database. unpwdb.passlimit: The maximum number of passwords 'passwords' will return default unlimited. passdb: The filename of an alternate password database. unpwdb.userlimit: The maximum number of...

Nmap NSE net: pgsql-brute

Performs password guessing against PostgreSQL. SYNTAX: pgsql.nossl: If set to '1' or 'true', disables SSL. pgsql.version: Force protocol version 2 or 3. passdb: The filename of an alternate password database. userdb: The filename of an alternate username database. unpwdb.passlimit: The maximum...