SUSE CVE-2018-14618

curl before version 7.61.1 is vulnerable to a buffer overrun in the NTLM authentication code. The internal function Curlntlmcoremknthash multiplies the length of the password by two SUM to figure out how large temporary storage area to allocate from the heap. The length value is then subsequently...

SUSE CVE-2020-8632

In cloud-init through 19.4, randuserpassword in cloudinit/config/ccsetpasswords.py has a small default pwlen value, which makes it easier for attackers to guess passwords...

SUSE CVE-2020-15115

etcd before versions 3.3.23 and 3.4.10 does not perform any password length validation, which allows for very short passwords, such as those with a length of one. This may allow an attacker to guess or brute-force users' passwords with little computational effort...

Nextcloud: No password length restriction in reset password endpoint

There was no password length restriction in the reset password endpoint of the Nextcloud platform, which could allow an attacker to perform a denial of service attack by entering a large number of characters as a password. The vulnerability has been mitigated by restricting users to use less than...

CVE-2022-41969

Nextcloud Server is an open source personal cloud server. Prior to versions 23.0.11, 24.0.7, and 25.0.0, there is no password length limit when creating a user as an administrator. An administrator can cause a limited DoS attack against their own server. Versions 23.0.11, 24.0.7, and 25.0.0 conta...

Code injection

Nextcloud Server is an open source personal cloud server. Prior to versions 23.0.11, 24.0.7, and 25.0.0, there is no password length limit when creating a user as an administrator. An administrator can cause a limited DoS attack against their own server. Versions 23.0.11, 24.0.7, and 25.0.0 conta...

Nextcloud 资源管理错误漏洞

Nextcloud is an open source suite of self-hosted file synchronization and sharing communication application platform from Nextcloud, Germany. A resource management error vulnerability exists in Nextcloud Server versions prior to 23.0.11, 24.0.7, and 25.0.0, which stems from creating a user as an...

PT-2022-26192 · Nextcloud +1 · Nextcloud Server +1

Name of the Vulnerable Software and Affected Versions: Nextcloud Server versions prior to 23.0.11 Nextcloud Server versions prior to 24.0.7 Nextcloud Server versions prior to 25.0.0 Description: The issue affects Nextcloud Server, an open source personal cloud server, where prior to versions...

OESA-2022-2079 sudo security update

Sudo is a program designed to allow a sysadmin to give limited root privileges to users and log root activity. The basic philosophy is to give as few privileges as possible but still allow people to get their work done. Security Fixes: Sudo 1.8.0 through 1.9.12, with the crypt password backend,...

Heap overflow

Sudo 1.8.0 through 1.9.12, with the crypt password backend, contains a plugins/sudoers/auth/passwd.c array-out-of-bounds error that can result in a heap-based buffer over-read. This can be triggered by arbitrary local users with access to Sudo by entering a password of seven characters or fewer...

PT-2022-24019 · Phpmyfaq · Phpmyfaq

Name of the Vulnerable Software and Affected Versions: phpMyFAQ versions prior to 3.1.8 Description: The issue concerns weak password requirements in the phpMyFAQ repository. Specifically, versions prior to 3.1.8 are affected due to inadequate password length requirements. Version 3.1.8 introduce...

Nextcloud: No password length limit when creating a user as an administrator

Hi, when I try to set the password while creating an account I noticed that you haven't kept any password limit. You need to decrease password length: There are two reasons for limiting the password size. For one, hashing a large amount of data can cause significant resource consumption on behalf...

etcd has no minimum password length

Vulnerability type Access Control Workarounds The etcdctl and etcd API do not enforce a specific password length during user creation or user password update operations. It is the responsibility of the administrator to enforce these requirements. Detail etcd does not perform any password length...

GHSA-MP5P-G2JV-R8QW rdiffweb contains Weak Password Requirements

rdiffweb version 2.4.1 has no password policy or password checking, which could make users vulnerable to brute force password guessing attacks. Version 2.4.2 enforces minimum and maximum password lengths...

rdiffweb contains Weak Password Requirements

rdiffweb version 2.4.1 has no password policy or password checking, which could make users vulnerable to brute force password guessing attacks. Version 2.4.2 enforces minimum and maximum password lengths...

PT-2022-20934 · Rdiffweb · Rdiffweb

Name of the Vulnerable Software and Affected Versions: rdiffweb versions prior to 2.4.2 Description: The issue is related to weak password requirements. Specifically, versions prior to 2.4.2 have no password policy or password checking, making users vulnerable to brute force password guessing...

php: password of excessive length triggers buffer overflow leading to RCE

A buffer overflow vulnerability was found in PHP when processing passwords in mysqlnd/pdo in mysqlndwireprotocol.c. When using the pdomysql extension with mysqlnd driver, if the third party is allowed to supply a MySQL database server password in the mysqlnd driver to the host for the connection,...

php: password of excessive length triggers buffer overflow leading to RCE

A buffer overflow vulnerability was found in PHP when processing passwords in mysqlnd/pdo in mysqlndwireprotocol.c. When using the pdomysql extension with mysqlnd driver, if the third party is allowed to supply a MySQL database server password in the mysqlnd driver to the host for the connection,...

UBUNTU-CVE-2022-31626

In PHP versions 7.4.x below 7.4.30, 8.0.x below 8.0.20, and 8.1.x below 8.1.7, when pdomysql extension with mysqlnd driver, if the third party is allowed to supply host to connect to and the password for the connection, password of excessive length can trigger a buffer overflow in PHP, which can...

trudesk Denial of Service Vulnerability

trudesk is an open source helpdesk/ticketing solution. A denial of service vulnerability exists in trudesk versions prior to 1.2.2, which stems from a lack of validation for password length and can be exploited by an attacker to cause a denial of service via a long password...