The passwordless present: Will biometrics replace passwords forever?

When it comes to securing your sensitive, personally identifiable information against criminals who can engineer countless ways to snatch it from under your nose, experts have long recommended the use of strong, complex passwords. Using long passphrases with combinations of numbers, letters, and...

Denial Of Service (DoS)

Kerberos is a network authentication system, which can improve the security of your network by eliminating the insecure practice of sending passwords over the network in unencrypted form. It allows clients and servers to authenticate to each other with the help of a trusted third party, the...

CVE-2020-5723

CVE-2020-5723 affects Grandstream UCM62xx/UCM6200 series (firmware 1.0.20.22 and earlier). Root cause: unencrypted user passwords stored in an SQLite database, enabling an attacker to retrieve passwords and potentially gain elevated privileges. Connected documents also reference related CVE-2020-...

OPENSUSE-SU-2020:0400-1 Security update for cloud-init

This update for cloud-init fixes the following security issues: - CVE-2020-8631: Replaced the theoretically predictable deterministic RNG with the system RNG bsc1162937. - CVE-2020-8632: Increased the default random password length from 9 to 20 bsc1162936. This update was imported from the...

Tips for Securing Remote Workers

As more and more employees are mandated to work from home, security and non-security professionals alike are left wondering what they can do to keep their data and systems safe. To help with this, we’ve compiled a list of some of the key things you can do to ensure your defenses are up—on or off...

CVE-2020-6794

CVE-2020-6794 (Thunderbird) : The vulnerability occurs when a user who saved passwords before Thunderbird 60 later sets a master password; an unencrypted copy of those passwords remains accessible because the legacy password file isn’t deleted during data migration to the new format introduced in...

Information Disclosure

ansible is vulnerable to information disclosure. The vulnerability exists as the svn command run by the subversion module does not allow a password to be passed securely, allowing the password to be read by a manged node at /proc//cmdline...

CVE-2020-3841

CVE-2020-3841 affects Safari Login AutoFill. The issue, tied to UI handling, allowed a local user to send a password unencrypted over the network. Apple fixed this with Safari 13.0.5 and iOS/iPadOS 13.3.1 (and related security content), addressing the vulnerability by improved input/UI handling. ...

CVE-2012-5623

CVE-2012-5623 concerns Squirrelmail 4.0 using the outdated MD5 hashing algorithm for passwords. According to the connected records, the issue arises from the use of MD5 for password hashing, which can lead to weakened password security. The NVD entry lists CVSSv3.1 metrics with a base score of 7....

Hashcracker - Python Hash Cracker

Supportedhashing algorithms: SHA512, SHA256, SHA384, SHA1, MD5 Features: auto detection of hashing algorithm based on length not recommended, bruteforce, password list Arguments: type: hash algorithm must be one of the supported hashing algorithms mentioned above or AUTO if you want to use...

CVE-2020-2130

Jenkins Harvest SCM Plugin 0.5.1 and earlier stores a password unencrypted in its global configuration file on the Jenkins master where it can be viewed by users with access to the master file system...

CVE-2020-2133

CVE-2020-2133 affects Jenkins Applatix Plugin (1.1 and earlier). The vulnerability arises from storing a password unencrypted in job config.xml on the Jenkins master, allowing access by users with Extended Read permission or anyone with access to the master filesystem. This can expose credentials...

CVE-2020-2132

CVE-2020-2132 affects Jenkins Parasoft Environment Manager Plugin 2.14 and earlier. The vulnerability stems from passwords stored unencrypted in job config.xml on the Jenkins master, allowing access by users with Extended Read permission or those with master-file access. Impact described in sourc...

CVE-2020-2129

CVE-2020-2129 affects Jenkins Eagle Tester Plugin versions 1.0.9 and earlier. The vulnerability arises from storing a password unencrypted in the plugin’s global configuration file on the Jenkins master, enabling access by users with master-file-system access. The connected sources corroborate th...

CVE-2012-4381

MediaWiki before 1.18.5, and 1.19.x before 1.19.2 saves passwords in the local database, 1 which could make it easier for context-dependent attackers to obtain cleartext passwords via a brute-force attack or, 2 when an authentication plugin returns a false in the strict function, could allow remo...

Default credentials

Opencast before 8.1 stores passwords using the rather outdated and cryptographically insecure MD5 hash algorithm. Furthermore, the hashes are salted using the username instead of a random salt, causing hashes for users with the same username and password to collide which is problematic especially...

CVE-2012-3823

CVE-2012-3823 affects Arial Campaign Enterprise prior to version 11.0.551. The vulnerability is that passwords are stored in clear text and may be retrieved, leading to potential exposure of user credentials. Impact is confidentiality-related (credentials exposure) with no evidence of integrity/a...

Here is a list of top 25 worst passwords of 2019

By Waqas If your password is on the list, the risk of having your account hacked and identity stolen is high. This is a post from HackRead.com Read the original post: Here is a list of top 25 worst passwords of 2019...

CVE-2019-19342

A flaw was found in Ansible Tower, versions 3.6.x before 3.6.2 and 3.5.x before 3.5.4, when /websocket is requested and the password contains the '' character. This request would cause a socket error in RabbitMQ when parsing the password and an HTTP error code 500 and partial password disclose wi...

CVE-2019-16673

An issue was discovered on Weidmueller IE-SW-VL05M 3.6.6 Build 16102415, IE-SW-VL08MT 3.5.2 Build 16102415, and IE-SW-PL10M 3.3.16 Build 16102416 devices. Passwords are stored in cleartext and can be read by anyone with access to the device...