1136 matches found
Creating and Managing Strong Passwords
NCCIC/US-CERT reminds users of the importance of creating and managing strong passwords. Passwords are often the only barrier between you and your personal information. There are several programs attackers can use to help guess or "crack" passwords. However, choosing strong passwords and keeping...
The digital entropy of death: what happens to your online accounts when you die
Unless you're planning on having your mind jammed inside some sort of computer chip, eventually mortality will catch up and you're going to have to work out what you'll do with all of your online accounts. When it's time to shuffle off this mortal coil, you might, theoretically, be slightly annoy...
CVE-2018-1372
IBM Security Guardium Big Data Intelligence SonarG 3.1 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. IBM X-Force ID: 137772...
pulp: Unsafe use of bash $RANDOM for NSS DB password and seed
Pulp makes unsafe use of Bash's $RANDOM to generate a NSS DB password and seed resulting in insufficient randomness. An attacker could potentially guess the seed used given enough time and compute resources...
Leaky Amazon S3 Bucket Exposes Personal Data of 12,000 Social Media Influencers
An erroneously configured Amazon S3 Simple Storage Service bucket managed by Paris marketing firm Octoly left contact information and personal details for more than 12,000 social media influencers. Octoly connects popular Instagram, Twitter and YouTube users with companies that provide them...
CVE-2017-15112
keycloak-httpd-client-install versions before 0.8 allow users to insecurely pass password through command line, leaking it via command history and process info to other local users...
Meltdown and Spectre Aren’t Business as Usual
The new year brought a new vulnerability type — the CPU-based Meltdown and Spectre bugs — that’s forcing vendors and IT departments to modify long-standing ways of identifying threats, prioritizing remediation, managing patches and evaluating risk. “Meltdown and Spectre are different...
CVE-2014-4999
CVE-2014-4999 affects the Kajam Ruby gem (1.0.3.rc2). The issue arises in vendor/plugins/dataset/lib/dataset/database/mysql.rb where the mysql user password is exposed on the command lines used by mysqldump (capture) and mysql (restore), enabling a local attacker to view the password by listing p...
With 1.4 Billion Stolen Log-Ins on the Dark Web, it’s Time to Take Password Management Seriously
Last week you may have seen some worrying news: researchers probing the darkest corners of the underground web found a secret trove containing 1.4 billion breached usernames and passwords. Yes, that’s right: 1.4 BILLION. Yours might very well be among them, and if you reuse the same password acro...
Over 400 Popular Sites Record Your Every Keystroke and Mouse Movement
How many times it has happened to you when you look for something online and the next moment you find its advertisement on almost every other web page or social media site you visit? Web-tracking is not new. Most of the websites log its users' online activities, but a recent study from Princeton...
Whois Maintainer Accidentally Makes Password Hashes Available For Download
The regional internet registrar that administers IP addresses for the Asia Pacific region accidentally leaked Whois database data, including hashed passwords, forcing it to reset all passwords for objects in its Whois database. According to Asia Pacific Network Information Center APNIC, the...
REMOTE CODE EXECUTION (CVE-2017-13772) WALKTHROUGH ON A TP-LINK ROUTER
INTRODUCTION In this post, I will be discussing my recent findings while conducting vulnerability research on a home router: TP-Link’s WR940N home WiFi router. This post will outline the steps taken to identify vulnerable code paths, and how we can exploit those paths to gain remote code executio...
Weak Password Hashing Algorithm
WordPress is vulnerable to collision attacks. It uses a weak MD-5 based password hashing algorithm, making it easier for attackers to obtain a valid password hash...
iOS Password Prompts are Ripe for Abuse
Apple’s policy to repeatedly ask users for their iTunes password needlessly exposes iOS device owners to possible phishing attacks, according a mobile app developer Felix Krause. Krause’s beef with Apple is that too often and seemingly at random times, popups deliver a dialogue box for users to...
Radancy: Weak password
It takes ash123456789123456789 as a password,which is not secure.It can be cracked using Dictionary,brute force etc attacks. Impact: If password complexity is not enforced people may tend to put easily guessable password which may be exploitable for a malicious user. Solution-To make it more...
August 31, 2017 – Morning Cyber Coffee Headlines – “Jack the Ripper” Edition
Good morning! Sit with Carbon Black this morning over a cup of coffee or tea and browse a few industry headlines to get the day started. We’ve got just enough information below to get you through that first cup…enjoy! August 31, 2017 - Headlines Carbon Black in the News: VMware advances applicati...
Legal Robot: Improper error message
Hi team, First of all congrats for good work to enforced the new password security policy during registration but the password error banner is not updated as per the changes. During registration it only shows the error when i enter the password if is is less than 8 chars. but if i enter the 8+...
MGASA-2017-0277 Updated jetty packages fix security vulnerability
Jetty is prone to a timing channel attack in util/security/Password.java, which makes it easier for remote attackers to obtain access by observing elapsed times before rejection of incorrect passwords CVE-2017-9735...
CVE-2017-11131
An issue was discovered in heinekingmedia StashCat through 1.7.5 for Android, through 0.0.80w for Web, and through 0.0.86 for Desktop. For authentication, the user password is hashed directly with SHA-512 without a salt or another key-derivation mechanism to enable a secure secret for...