openSUSE Security Update : glibc (openSUSE-SU-2011:0921-1)

The implementation of the blowfish based password hashing method had a bug affecting passwords that contain 8bit characters e.g. umlauts. Affected passwords are potentially faster to crack via brute-force methods CVE-2011-2483. SUSE's crypt implementation supports the blowfish password hashing...

openSUSE Security Update : yast2-core (openSUSE-SU-2011:0921-2)

This update contains yast2 core changes to change the hash generation of new passwords to the new secure style. Please read the general notes below : The implementation of the blowfish based password hashing method had a bug affecting passwords that contain 8bit characters e.g. umlauts. Affected...

openSUSE Security Update : apache2-mod_php5 (openSUSE-SU-2011:1138-1)

The blowfish password hashing implementation did not properly handle 8-characters in passwords, which made it easier for attackers to crack the hash CVE-2011-2483. After this update existing hashes with id '$2a$' for passwords that contain 8-bit characters will no longer be compatible with newly...

Authentication flaw

The Authentication component in TYPO3 before 6.2, when salting for password hashing is disabled, does not require knowledge of the cleartext password if the password hash is known, which allows remote attackers to bypass authentication and gain access to the backend by leveraging knowledge of a...

CVE-2014-3945

TYPO3 Authentication bypass (CVE-2014-3945) affects TYPO3 Core prior to 6.2. When password hashing salt is disabled, an attacker who knows a valid password hash can log in without knowing the cleartext password, potentially gaining backend access remotely. This is described across multiple source...

PT-2014-5625

Name of the Vulnerable Software and Affected Versions TYPO3 versions prior to 6.2 Description The issue concerns the Authentication component in TYPO3. When salting for password hashing is disabled, it does not require knowledge of the cleartext password if the password hash is known. This allows...

CVE-2014-2354

Cogent DataHub before 7.3.5 does not use a salt during password hashing, which makes it easier for context-dependent attackers to obtain cleartext passwords via a brute-force attack...

Design/Logic Flaw

Cogent DataHub before 7.3.5 does not use a salt during password hashing, which makes it easier for context-dependent attackers to obtain cleartext passwords via a brute-force attack...

CVE-2014-2354 Cogent DataHub Use of Password Hash With Insufficient Computational Effort

Cogent DataHub before 7.3.5 does not use a salt during password hashing, which makes it easier for context-dependent attackers to obtain cleartext passwords via a brute-force attack...

CVE-2014-2354

CVE-2014-2354 affects Cogent DataHub before 7.3.5, where usernames/passwords are stored unsalted, making brute-force attacks easier to recover cleartext passwords. The vulnerability is not remotely exploitable for the password-hash issue, though other issues in the advisory may be. Cogent release...

CVE-2014-2354: Use of Password Hash With Insufficient Computational Effort

Cogent DataHub before 7.3.5 does not use a salt during password hashing, which makes it easier for context-dependent attackers to obtain cleartext passwords via a brute-force attack...

PT-2014-4644

Name of the Vulnerable Software and Affected Versions Cogent DataHub versions prior to 7.3.5 Description The issue makes it easier for attackers to obtain cleartext passwords via a brute-force attack because it does not use a salt during password hashing. Recommendations For versions prior to...

PT-2014-2837 · Debian +1 · Debian +1

Name of the Vulnerable Software and Affected Versions: Debian affected versions not specified Description: The issue concerns a Debian patch for GNU GRUB that uses world-readable permissions for the grub.cfg file. This allows local users to obtain password hashes by reading the password pbkdf2...

CVE-2013-0173

Foreman before 1.1 uses a salt of "foreman" to hash root passwords, which makes it easier for attackers to guess the password via a brute force attack...

CVE-2013-0173

Foreman before version 1.1 uses a fixed salt named “foreman” to hash root passwords, making brute-force guessing easier. The vulnerability affects the password-hashing path in Foreman pre-1.1; the root credential protection is weakened due to the non-unique, predictable salt. The available source...

CVE-2013-6445

Cumin aka MRG Management Console, as used in Red Hat Enterprise MRG 2.5, uses the DES-based crypt function to hash passwords, which makes it easier for attackers to obtain sensitive information via a brute-force attack...

Design/Logic Flaw

Cumin aka MRG Management Console, as used in Red Hat Enterprise MRG 2.5, uses the DES-based crypt function to hash passwords, which makes it easier for attackers to obtain sensitive information via a brute-force attack...

cumin: weak password hashing

Cumin aka MRG Management Console, as used in Red Hat Enterprise MRG 2.5, uses the DES-based crypt function to hash passwords, which makes it easier for attackers to obtain sensitive information via a brute-force attack...

Moderate: Red Hat Security Advisory: Red Hat Enterprise MRG Messaging 2.5 security, bug fix, and enhancement update

Updated Messaging component packages that fix one security issue, several bugs, and add various enhancements are now available for Red Hat Enterprise MRG 2.5 for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having Moderate security impact. A Common...

cumin: weak password hashing

Cumin aka MRG Management Console, as used in Red Hat Enterprise MRG 2.5, uses the DES-based crypt function to hash passwords, which makes it easier for attackers to obtain sensitive information via a brute-force attack...