CVE-2016-5918

IBM Tivoli Storage Manager HSM for Windows displays the encrypted Tivoli Storage Manager password in application trace output if the password access option is prompt and the password is changed...

Design/Logic Flaw

hitek.jar in Hitek Software's Automize uses weak encryption when encrypting SSH/SFTP and Encryption profile passwords. This allows an attacker to retrieve the encrypted passwords from sshProfiles.jsd and encryptionProfiles.jsd and decrypt them to recover cleartext passwords. All 10.x up to and...

[SECURITY] Fedora 24 Update: cracklib-2.9.6-4.fc24

CrackLib tests passwords to determine whether they match certain security-oriented characteristics, with the purpose of stopping users from choosing passwords that are easy to guess. CrackLib performs several tests on passwords: it tries to generate words from a username and gecos entry and check...

[SECURITY] Fedora 25 Update: cracklib-2.9.6-4.fc25

CrackLib tests passwords to determine whether they match certain security-oriented characteristics, with the purpose of stopping users from choosing passwords that are easy to guess. CrackLib performs several tests on passwords: it tries to generate words from a username and gecos entry and check...

DailyMotion Hacked — 85 Million User Accounts Stolen

Another day, another data breach. This time a popular video sharing platform DailyMotion has allegedly been hacked and tens of millions of users information have been stolen. Breach notification service LeakedSource announced the data breach on Monday after the company obtained 85.2 Million recor...

US-CERT Alerts Users to Holiday Phishing Scams and Malware Campaigns

US-CERT reminds users to remain vigilant when browsing or shopping online this holiday season. Ecards from unknown senders may contain malicious links. Fake advertisements or shipping notifications may deliver infected attachments. Spoofed email messages and fraudulent posts on social networking...

Lepton 2.2.2 Stable CSRF / Open Redirect / Password Handling Vulnerabilities

Lepton version 2.2.2 Stable suffers from password handling, insecure bruteforce protection, cross site request forgery, and open redirection vulnerabilities. 1. Introduction Affected Product: LEPTON 2.2.2 stable Fixed in: 2.3.0 Fixed Version http://www.lepton-cms.org/posts/ Link:...

Questions Mount Around Yahoo Breach

As Yahoo continues to investigate the biggest data breach in history, pressure is mounting on the company to admit when it knew about the attack, whether there was a delay in reporting it, and also about how it implements cryptography to secure data it’s responsible for. Security company Venafi...

CVE-2016-6340

CVE-2016-6340 affects Red Hat QuickStart Cloud Installer (QCI): the kickstart file forces MD5 passwords on deployed systems, enabling brute-force recovery of cleartext passwords. This is described by NVD as high-impact (CVSS3 base 8.4) with local attacker access and strong confidentiality/integri...

Jobberbase 2.0 - Multiple Vulnerabilities

Jobberbase 2.0 - Multiple Vulnerabilities Jobberbase: http://www.jobberbase.com/ Version: 2.0 By Ross Marks: http://www.rossmarks.co.uk 1 Local path disclosure - change any variable to an array and in most cases it will tell you the local path where the application is installed eg...

CVE-2016-3640

The SAP HANA DB vulnerability CVE-2016-3640 affects Extended Application Services (XS/XS Engine) in SAP HANA DB version 1.00.091.00.1418659308. The issue allows local users to disclose sensitive password information via vectors related to passwords in Web Dispatcher trace files (as described in S...

CVE-2016-5260

Mozilla Firefox before 48.0 mishandles changes from 'INPUT type="password"' to 'INPUT type="text"' within a single Session Manager session, which might allow attackers to discover cleartext passwords by reading a session restoration file...

CVE-2016-4595

Safari Login AutoFill in Apple OS X before 10.11.6 allows physically proximate attackers to discover passwords by reading the screen during the login procedure...

THC-Hydra 8.2 - Network Logon Cracker

A very fast network logon cracker which support many different services. See feature sets and services coverage page - incl. a speed comparison against ncrack and medusa.Number one of the biggest security holes are passwords, as every password security study shows. This tool is a proof of concept...

Facebook CEO Zuckerberg's Twitter, Pinterest accounts Hacked! And the Password was...

The man who runs the biggest social network and continuously implements new security measures to boost its billion users security, himself failed to follow basics of Internet security for his own online accounts. Yes, I’m talking about Facebook CEO Mark Zuckerberg, who had his Twitter and Pintere...

CVE-2016-3724

CVE-2016-3724 affects Jenkins before 2.3 and LTS before 1.651.2. The issue allows remote authenticated users with extended read access to extract sensitive password information by reading a job configuration. Root cause: exposed password data in job configuration accessible to users with read per...

New Relic: Missing rate limit on password

Hello, in login page https://login.newrelic.com/login there is no rate limit for brute force attack on password which allow attacker to do as much he can from requests for guessing the user password. the same was happened in Facebook newrelck.pngF93837 Thaanks...

CVE-2015-8673

The CVE-2015-8673 issue affects Huawei TE30/TE40/TE50/TE60 video conferencing endpoints running software before V100R001C10SPC100. The Debug account password change vulnerability lets a physically proximate attacker change the Debug account password without entering the old password when an unatt...

One Crucible admin can get access to repository password provided by another admin

It was possible to retrieve the repository passwords provided by another administrator via web browser session. It was fixed now, so password can still be changed or unset if necessary, but it is not possible to read its contents...

US-CERT Alerts Users to Holiday Phishing Scams and Malware Campaigns

US-CERT reminds users to remain vigilant when browsing or shopping online this holiday season. Ecards from unknown senders may contain malicious links. Fake advertisements or shipping notifications may deliver infected attachments. Spoofed email messages and fraudulent posts on social networking...