The vulnerability of the software interface of the FortiWeb Manager, a centralized control system for network switches, relates to access control deficiencies, allowing an intruder to gain access to the system using an administrator account.

The vulnerability of the software interface for centralized control of network switches, FortiWeb Manager, is related to the lack of password verification for the admin account. Exploiting this vulnerability could allow a malicious actor, operating remotely and having access to the web interface,...

openSUSE Security Update : 389-ds (openSUSE-2017-1396)

This update for 389-ds fixes the following issues : - CVE-2017-7551: 389-ds-base: Password brute-force possible for locked account due to different return codes bsc1051997 - CVE-2016-4992: 389-ds: Information disclosure via repeated use of LDAP ADD operation bsc997256 - CVE-2016-5405: 389-ds:...

Coursera: No Password Verification on Changing Email Address Cause Account takeover

In coursera.org website, there is no password verification on changing email id. Generally when user try to change the password , they were asked to verify the request by entering old password. For the same reason a verification should be there on changing email. But the worst part is, when user...

tomcat: timing attack in Realm implementation

The Realm implementations did not process the supplied password if the supplied user name did not exist. This made a timing attack possible to determine valid user names. Note that the default configuration includes the LockOutRealm which makes exploitation of this vulnerability harder...

Archive Cryptography: unarcrypto

Archive Cryptography unarcrypto.py is an educational tool to depict the use of cryptography for password verification, headers and content encryption by popular archivers: zip, 7zip, rar v3 and v5. Supported archives format, encryption and compression algorithms: zip password protected or not,...

Timing Attack

jasypt is vulnerable to timing attacks. The attacks are possible because it uses Arrays.equals to verify passwords with different lengths, thereby revealing the time taken to compare the passwords...

CVE-2016-10321

web2py before 2.14.6 does not properly check if a host is denied before verifying passwords, allowing a remote attacker to perform brute-force attacks...

CVE-2016-10321

web2py before 2.14.6 does not properly check if a host is denied before verifying passwords, allowing a remote attacker to perform brute-force attacks...

UBUNTU-CVE-2016-10321

web2py before 2.14.6 does not properly check if a host is denied before verifying passwords, allowing a remote attacker to perform brute-force attacks...

Logic Flaw Vulnerability at My NJ Client APP Change Password Function

My Nanjing Client APP is a city-level public service mobile application that integrates all kinds of living information in Nanjing. A logic flaw exists in the password change function of MyNJ Client APP. Since the original password is not verified when changing the password, it allows an attacker...

Password Verification Bypass

restauth is vulnerable to password verification bypass. It sets SECURECACHE = False for services by default in the standard settings, which leads to missing password verification...

Fluxion - WPA/WPA2 Security Hacked Without Brute Force

Fluxion is a remake of linset by vk496 with less bugs and more features. It's compatible with the latest release of Kali Rolling. Latest builds stable and beta HERE . If you new, please start reading the wiki Fluxion GUI How it works Scan the networks. Capture a handshake can't be used without a...

Updated slock packages fix security vulnerability

The slock utility is susceptible to crash when verifying a password for a user without a valid shadow hash entry CVE-2016-6866...

MGASA-2016-0308 Updated slock packages fix security vulnerability

The slock utility is susceptible to crash when verifying a password for a user without a valid shadow hash entry CVE-2016-6866...

Security Advisory - Two Vulnerabilities in Huawei WS331a

Huawei WS331a is a Mini Wireless route. There is a Cross-site request forgery CSRF vulnerability in the management interface of WS331a products, an unauthenticated attacker could exploit this vulnerability to perform a CSRF attack. Successful exploit could allow the attacker to submit special...

HackerOne: Missing rate limit on critical user actions e.g. reset password, change email, disable account.

Hi I found that there are no rate limitations present on actions that require a password inside the account settings. Actions: Paypal email change Account email change Password Change Disable Account this will not be useful to attacker These sensitive actions require additional verification of...

Secret Chat Password Bypass Vulnerability

Secret Chat is a LAN chat tool. The tool suffers from a password bypass vulnerability when verifying account passwords. An attacker can attempt to crack the password and obtain user information...

Updated pam package fixes security vulnerability

If SELinux is enabled, the unixrunhelperbinary function in Linux-PAM 1.1.8 and earlier hangs indefinitely when verifying a password of 65536 characters, which allows attackers to conduct username enumeration and denial of service attacks CVE-2015-3238...

PeerFTP Server <= 4.01 - Remote Crash PoC

No description provided by source. !/usr/bin/python PeerFTP Server =v4.01 Remote Crash PoC written by localh0t Date: 19/03/12 Contact: [email protected] Follow: @mattdch www.localh0t.com.ar from socket import import sys, struct, os if lensys.argv 3: print \nPeerFTP Server =v4.01 Remote Crash PoC...

CVE-2014-0924

IBM MessageSight 1.x before 1.1.0.0-IBM-IMA-IT01015 does not verify that all of the characters of a password are correct, which makes it easier for remote authenticated users to bypass intended access restrictions by leveraging knowledge of a password substring...