Debian DSA-3075-1 : drupal7 - security update

Two vulnerabilities were discovered in Drupal, a fully-featured content management framework. The Common Vulnerabilities and Exposures project identifies the following issues : - CVE-2014-9015 Aaron Averill discovered that a specially crafted request can give a user access to another user's...

Debian Security Advisory DSA 3075-1 (drupal7 - security update)

Two vulnerabilities were discovered in Drupal, a fully-featured content management framework. The Common Vulnerabilities and Exposures project identifies the following issues: CVE-2014-9015 Aaron Averill discovered that a specially crafted request can give a user access to another user OpenVAS...

drupal: session hijacking and denial of service

Custom configured session.inc and password.inc need to be audited as well to verify if they are prone to the following vulnerabilities. More information can be found in the upstream advisory 0. - CVE-2014-9015 session hijacking Aaron Averill discovered that a specially crafted request can give a...

DSA-3075-1 drupal7 - security update

Bulletin has no description...

Mozilla MDN Password Disclosure Affects 76,000 Developers

Some members of the Mozilla Developer Network are being advised to change their passwords after email addresses and encrypted credentials were disclosed on a public server. Mozilla director of developer relations Stormy Peters said the organization has been investigating the disclosure for 10 day...

RHEL 6 : MRG (RHSA-2014:0440)

Updated Grid component packages that fix two security issues, multiple bugs, and provide several enhancements are now available for Red Hat Enterprise MRG 2.5 for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having Moderate security impact. Common...

MoME CMS <= 0.8.5 - Remote Login Bypass Exploit

No description provided by source. '/ -.- --------------------oOO------OOo------------------- | MoME CMS = 0.8.5 Remote Login Bypass Exploit | | works only with magicquotesgpc = off | ------------------------------------------------------ ! Discovered: cr4wl3r cr4wl3r!linuxmail.org ! Download:...

Simple HRM System <= 2.3 - Multiple Vulnerabilities

No description provided by source. Exploit Title: Multiple Vulnerabilities in Simple HRM system v2.3 and below Date: 12/04/2013 Exploit Author: Doraemon Vendor Homepage: http://www.simplehrm.com/ Software Link: http://sourceforge.net/projects/simplehrm/ Version: 2.2/2.3 Tested on: 2.2 & 2.3 CVE :...

openSUSE Security Update : yast2-core (openSUSE-SU-2011:0921-2)

This update contains yast2 core changes to change the hash generation of new passwords to the new secure style. Please read the general notes below : The implementation of the blowfish based password hashing method had a bug affecting passwords that contain 8bit characters e.g. umlauts. Affected...

openSUSE Security Update : yast2-core (openSUSE-SU-2011:0921-2)

This update contains yast2 core changes to change the hash generation of new passwords to the new secure style. Please read the general notes below : The implementation of the blowfish based password hashing method had a bug affecting passwords that contain 8bit characters e.g. umlauts. Affected...

openSUSE Security Update : apache2-mod_php5 (openSUSE-SU-2011:1137-1)

The blowfish password hashing implementation did not properly handle 8-characters in passwords, which made it easier for attackers to crack the hash CVE-2011-2483. After this update existing hashes with id '$2a$' for passwords that contain 8-bit characters will no longer be compatible with newly...

openSUSE Security Update : apache2-mod_php5 (openSUSE-SU-2011:1138-1)

The blowfish password hashing implementation did not properly handle 8-characters in passwords, which made it easier for attackers to crack the hash CVE-2011-2483. After this update existing hashes with id '$2a$' for passwords that contain 8-bit characters will no longer be compatible with newly...

openSUSE Security Update : glibc (openSUSE-SU-2011:0921-1)

The implementation of the blowfish based password hashing method had a bug affecting passwords that contain 8bit characters e.g. umlauts. Affected passwords are potentially faster to crack via brute-force methods CVE-2011-2483. SUSE's crypt implementation supports the blowfish password hashing...

openSUSE Security Update : glibc (openSUSE-SU-2011:0921-1)

The implementation of the blowfish based password hashing method had a bug affecting passwords that contain 8bit characters e.g. umlauts. Affected passwords are potentially faster to crack via brute-force methods CVE-2011-2483. SUSE's crypt implementation supports the blowfish password hashing...

Authentication flaw

The Authentication component in TYPO3 before 6.2, when salting for password hashing is disabled, does not require knowledge of the cleartext password if the password hash is known, which allows remote attackers to bypass authentication and gain access to the backend by leveraging knowledge of a...

CVE-2014-3945

TYPO3 Authentication bypass (CVE-2014-3945) affects TYPO3 Core prior to 6.2. When password hashing salt is disabled, an attacker who knows a valid password hash can log in without knowing the cleartext password, potentially gaining backend access remotely. This is described across multiple source...

CVE-2014-2354

Cogent DataHub before 7.3.5 does not use a salt during password hashing, which makes it easier for context-dependent attackers to obtain cleartext passwords via a brute-force attack...

Design/Logic Flaw

Cogent DataHub before 7.3.5 does not use a salt during password hashing, which makes it easier for context-dependent attackers to obtain cleartext passwords via a brute-force attack...

CVE-2014-2354 Cogent DataHub Use of Password Hash With Insufficient Computational Effort

Cogent DataHub before 7.3.5 does not use a salt during password hashing, which makes it easier for context-dependent attackers to obtain cleartext passwords via a brute-force attack...

CVE-2014-2354

CVE-2014-2354 affects Cogent DataHub before 7.3.5, where usernames/passwords are stored unsalted, making brute-force attacks easier to recover cleartext passwords. The vulnerability is not remotely exploitable for the password-hash issue, though other issues in the advisory may be. Cogent release...