683 matches found
CVE-2020-17494
Untangle Firewall NG before 16.0 uses MD5 for passwords...
ipa: No password length restriction leads to denial of service
A flaw was found in IPA. When sending a very long password = 1,000,000 characters to the server, the password hashing process could exhaust memory and CPU leading to a denial of service and the website becoming unresponsive. The highest threat from this vulnerability is to system availability...
openSUSE Security Update : nextcloud (openSUSE-2020-1652)
This update for nextcloud fixes the following issues : nextcloud version 20.0.0 fix some security issues : - NC-SA-2020-037 PIN for passwordless WebAuthm is asked for but not verified - NC-SA-2020-033 CVE-2020-8228 Missing rate limit on signup page - NC-SA-2020-029 CVE-2020-8233, boo1177346...
Nextcloud: Possible denial of service when entering a loooong password
You can create a very long password until you get the last user to put and aries or DoS. Normally passwords have 8-10-24 digits. By sending a very long password 1.000.000 characters Usually this problem is caused by a vulnerable password hashing implementation. When a long password is sent, the...
CVE-2020-14489
OpenClinic GA 5.09.02 and 5.89.05b stores passwords using inadequate hashing complexity, which may allow an attacker to recover passwords using known password cracking techniques...
CVE-2020-14489
OpenClinic GA 5.09.02 and 5.89.05b stores passwords using inadequate hashing complexity, which may allow an attacker to recover passwords using known password cracking techniques...
Design/Logic Flaw
OpenClinic GA 5.09.02 and 5.89.05b stores passwords using inadequate hashing complexity, which may allow an attacker to recover passwords using known password cracking techniques...
CVE-2020-14489
OpenClinic GA versions 5.09.02 and 5.89.05b are affected by CVE-2020-14489 due to storing passwords with inadequate hashing complexity, potentially enabling password recovery via known cracking techniques. Affected component: password storage mechanism. Impact: attacker could recover user passwor...
CVE-2020-14489 OpenClinic GA
OpenClinic GA 5.09.02 and 5.89.05b stores passwords using inadequate hashing complexity, which may allow an attacker to recover passwords using known password cracking techniques...
UBUNTU-CVE-2020-1722
A flaw was found in all ipa versions 4.x.x through 4.8.0. When sending a very long password = 1,000,000 characters to the server, the password hashing process could exhaust memory and CPU leading to a denial of service and the website becoming unresponsive. The highest threat from this...
CVE-2020-1722
A flaw was found in all ipa versions 4.x.x through 4.8.0. When sending a very long password = 1,000,000 characters to the server, the password hashing process could exhaust memory and CPU leading to a denial of service and the website becoming unresponsive. The highest threat from this...
PT-2020-14913 · Freeipa +6 · Ipa +6
Name of the Vulnerable Software and Affected Versions: ipa versions 4.x.x through 4.8.0 Description: A flaw was found in the password hashing process. When a very long password = 1,000,000 characters is sent to the server, it could exhaust memory and CPU, leading to a denial of service and the...
CVE-2020-1722
A flaw was found in IPA. When sending a very long password = 1,000,000 characters to the server, the password hashing process could exhaust memory and CPU leading to a denial of service and the website becoming unresponsive. The highest threat from this vulnerability is to system availability...
Nextcloud: Possible denial of service when entering a loooong password
You can create a very long password until you get the last user to put and aries or DoS. Normally passwords have 8-10-24 digits. By sending a very long password 1.000.000 characters Usually this problem is caused by a vulnerable password hashing implementation. When a long password is sent, the...
Linux: Password hashing algorithm
The hashing algorithm can be set in following module: - pamunix: Module for traditional password authentication Use the sha512 option to enforce encryption with the SHA512 algorithm. If the SHA512 algorithm is not known to the crypt function, fall back to MD5. Copyright C 2020 Greenbone Networks...
Opencast < 8.1.0 Password Hashing Vulnerability
Opencast is prone to an insecure password hashing vulnerability. Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free...
Password Hashing: Do not use MD5
Impact User passwords are stored in the database using the rather outdated and cryptographically insecure MD5 hash algorithm. Furthermore, the hashes are salted using the username instead of a random salt, causing hashes for users with the same username and password to collide which is problemati...
CVE-2020-5229 Opencast stores passwords using outdated MD5 hash algorithm
Opencast before 8.1 stores passwords using the rather outdated and cryptographically insecure MD5 hash algorithm. Furthermore, the hashes are salted using the username instead of a random salt, causing hashes for users with the same username and password to collide which is problematic especially...
Cryptographic Issues
Overview bcrypt is an A library to help you hash passwords. Affected versions of this package are vulnerable to Cryptographic Issues. When hashing a password containing an ASCII NUL character, that character acts as the string terminator. Any following characters are ignored. Remediation Upgrade...