Default credentials

Red Hat Network RHN Satellite Server 5.4 does not use a time delay after a failed login attempt, which makes it easier for remote attackers to conduct brute force password guessing attacks...

CVE-2011-0718

The CVE-2011-0718 issue affects Red Hat Network Satellite Server 5.4, where no time delay is enforced after a failed login, enabling potential brute‑force password guessing from remote attackers. Connected sources confirm this is addressed by the Red Hat advisory RHSA-2011:0300, which provides up...

Zeus/SpyEye Merger Promises More Sophisticated Bots

The recent merger of the Zeus and SpyEye botnets has created a mega-botnet that promises to increase the effectiveness, complexity, and prevalence of malware across the Web, according to a blog post by Francois Paget of McAfee Labs. The SpyEye/ZS Toolkit v1.4.1, the first evidence of a long-rumor...

http-form-brute NSE Script

Performs brute force password auditing against http form-based authentication. This script uses the unpwdb and brute libraries to perform password guessing. Any successful guesses are stored in the nmap registry, using the creds library, for other scripts to use. The script automatically attempts...

drda-brute NSE Script

Performs password guessing against databases supporting the IBM DB2 protocol such as Informix, DB2 and Derby Script Arguments drda-brute.threads the amount of accounts to attempt to brute force in parallel default 10. drda-brute.dbname the database name against which to guess passwords default...

CVE-2009-4909

admin/index.php in oBlog allows remote attackers to conduct brute-force password guessing attacks via HTTP requests...

Default credentials

admin/index.php in oBlog allows remote attackers to conduct brute-force password guessing attacks via HTTP requests...

CVE-2009-4909

admin/index.php in oBlog allows remote attackers to conduct brute-force password guessing attacks via HTTP requests...

CVE-2009-4909

The provided documents identify CVE-2009-4909 as a vulnerability in oBlog’s admin/index.php that allows remote attackers to perform brute-force password guessing via HTTP requests. This mode cites concrete details: affected component is the oBlog admin login, and the root cause is insufficient pr...

ms-sql-brute NSE Script

Performs password guessing against Microsoft SQL Server ms-sql. Works best in conjunction with the broadcast-ms-sql-discover script. SQL Server credentials required: No will not benefit from mssql.username & mssql.password. Run criteria: Host script: Will run if the mssql.instance-all,...

afp-brute NSE Script

Performs password guessing against Apple Filing Protocol AFP. Script Arguments afp.password, afp.username See the documentation for the afp library. passdb, unpwdb.passlimit, unpwdb.timelimit, unpwdb.userlimit, userdb See the documentation for the unpwdb library. Example Usage nmap -p 548 --scrip...

pgsql-brute NSE Script

Performs password guessing against PostgreSQL. Script Arguments pgsql.version Force protocol version 2 or 3. pgsql.nossl If set to 1 or true, disables SSL. passdb, unpwdb.passlimit, unpwdb.timelimit, unpwdb.userlimit, userdb See the documentation for the unpwdb library. Example Usage nmap -p 5432...

mysql-brute NSE Script

Performs password guessing against MySQL. See also: mysql-empty-password.nse Script Arguments mysql-brute.timeout socket timeout for connecting to MySQL default 5s passdb, unpwdb.passlimit, unpwdb.timelimit, unpwdb.userlimit, userdb See the documentation for the unpwdb library. creds.service,...

CVE-2009-4304

CVE-2009-4304 affects Moodle 1.8 before 1.8.11 and 1.9 before 1.9.7, where config.php does not use a random password salt, enabling easier brute‑force password guessing. Public documents indicate the fix is to upgrade to a newer Moodle version (e.g., 1.9.7), as referenced by Debian/OpenSUSE/OpenU...

Design/Logic Flaw

tog-pegasus in OpenGroup Pegasus 2.7.0 on Red Hat Enterprise Linux RHEL 5, Fedora 9, and Fedora 10 does not log failed authentication attempts to the OpenPegasus CIM server, which makes it easier for remote attackers to avoid detection of password guessing attacks...

CVE-2008-4315

tog-pegasus in OpenGroup Pegasus 2.7.0 on Red Hat Enterprise Linux RHEL 5, Fedora 9, and Fedora 10 does not log failed authentication attempts to the OpenPegasus CIM server, which makes it easier for remote attackers to avoid detection of password guessing attacks...

CVE-2008-4315

CVE-2008-4315 affects tog-pegasus (OpenPegasus WBEM) on RHEL 5, Fedora 9/10. The root cause is that failed authentication attempts to the OpenPegasus CIM server are not logged, which can enable password-guessing attacks to go undetected. Public references in connected documents show Red Hat/CentO...

tog security update

CentOS Errata and Security Advisory CESA-2008:1001 Updated tog-pegasus packages that fix security issues are now available for Red Hat Enterprise Linux 5. This update has been rated as having important security impact by the Red Hat Security Response Team. The tog-pegasus packages provide...

tog-pegasus: failed authentication attempts not logged via PAM

tog-pegasus in OpenGroup Pegasus 2.7.0 on Red Hat Enterprise Linux RHEL 5, Fedora 9, and Fedora 10 does not log failed authentication attempts to the OpenPegasus CIM server, which makes it easier for remote attackers to avoid detection of password guessing attacks...

Important: Red Hat Security Advisory: tog-pegasus security update

Updated tog-pegasus packages that fix security issues are now available for Red Hat Enterprise Linux 5. This update has been rated as having important security impact by the Red Hat Security Response Team. The tog-pegasus packages provide OpenPegasus Web-Based Enterprise Management WBEM services...