80 matches found
PT-2018-6398
Name of the Vulnerable Software and Affected Versions: gps-server.net GPS Tracking Software self hosted versions 2.x Description: The issue concerns a password reset procedure that allows immediate password resets upon an unauthenticated request. After the reset, an email is sent with a new,...
Apache OpenMeetings < 3.1.1 Multiple Vulnerabilities
Apache OpenMeetings is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:apache:openmeetings";...
Predictable Password Recovery
Moodle is vulnerable to predictable password recovery. The vulnerability exists because of not enough randomization of PHP mtrand function used in randomstring and complexrandomstring functions...
PT-2017-7742
Name of the Vulnerable Software and Affected Versions NETGEAR Arlo base stations versions 1.7.5 6178 and earlier NETGEAR Arlo Q devices versions 1.8.0 5551 and earlier NETGEAR Arlo Q Plus devices versions 1.8.1 6094 and earlier Description The issue allows remote attackers to obtain access via a...
CVE-2016-0783: Exposure of Sensitive Information to an Unauthorized Actor
The sendHashByUser function in Apache OpenMeetings before 3.1.1 generates predictable password reset tokens, which makes it easier for remote attackers to reset arbitrary user passwords by leveraging knowledge of a user name and the current system time...
CVE-2013-1941
The installation routine in ownCloud Server before 4.0.14, 4.5.x before 4.5.9, and 5.0.x before 5.0.4 uses the time function to seed the generation of the PostgreSQL database user password, which makes it easier for remote attackers to guess the password via a brute force attack...
CoSoSys Endpoint Protector 4 Predictable Password
The remote CoSoSys Endpoint Protector 4 is affected by a password disclosure flaw. Specifically, the 'epproot' account is set to the default password 'eroot!00$SUMRO', where $SUM is the sum of the 9 digits in the appliance serial number. C Tenable Network Security, Inc. include"compat.inc";...
CoSoSys Endpoint Protector 4 appliance contains a predictable password for root-equivalent account vulnerability
Overview CoSoSys Endpoint Protector 4 appliance contains a predictable password for root-equivalent accounts. Description According to the CoSoSys's website the Endpoint Protector 4 appliance is a DLP product used to prevent users from taking unauthorized data outside the company or bringing...
CoSoSys Endpoint Protector - Predictable Password Generation
source: https://www.securityfocus.com/bid/55570/info CoSoSys Endpoint Protector is prone to an insecure password generation vulnerability. Successfully exploiting this issue may allow an attacker to guess generated passwords and gain access to affected appliances. CoSoSys Endpoint Protector 4 is...
Anatomy of a LulzSec Attack 'Singles Out' Web 2.0 Weakness
A new report analyzing a recent attack on a military dating site underscores the need for stronger safeguards on social networks. As part of its Hacker Intelligence Initiative, database and application security provider Imperva deconstructed a March attack by the hacker collective LulzSec on...
RuggedCom Rugged Operating System (ROS) contains hard-coded user account with predictable password
Overview RuggedCom Rugged Operating System ROS contains a hard-coded user account with a predictable password. Description RuggedCom Rugged Operating System ROS, used in RuggedCom network infrastructure devices, contains a hard-coded user account named "factory" that cannot be disabled. The...
RuggedCom Rugged Operating System Vulnerability
RuggedCom Rugged Operating System ROS, used in RuggedCom network infrastructure devices, contains a hard-coded user account with a predictable password. This user account cannot be manually disabled. An attacker who successfully guesses the password may be able to gain complete administrative...
Ubuntu 6.06 LTS / 7.10 / 8.04 LTS / 8.10 : vm-builder vulnerability (USN-670-1)
Mathias Gug discovered that vm-builder improperly set the root password when creating virtual machines. An attacker could exploit this to gain root privileges to the virtual machine by using a predictable password. This vulnerability only affects virtual machines created with vm-builder under...
Ubuntu Update for vm-builder vulnerability USN-670-1
Ubuntu Update for Linux kernel vulnerabilities USN-670-1 OpenVAS Vulnerability Test $Id: gbubuntuUSN6701.nasl 7969 2017-12-01 09:23:16Z santu $ Ubuntu Update for vm-builder vulnerability USN-670-1 Authors: System Generated Check Copyright: Copyright c 2009 Greenbone Networks GmbH,...
[USN-670-1] VMBuilder vulnerability
=========================================================== Ubuntu Security Notice USN-670-1 November 13, 2008 vm-builder vulnerability https://bugs.launchpad.net/+bug/296841 =========================================================== A security issue affects the following Ubuntu releases: Ubuntu...
USN-670-1: VMBuilder vulnerability
Mathias Gug discovered that vm-builder improperly set the root password when creating virtual machines. An attacker could exploit this to gain root privileges to the virtual machine by using a predictable password. This vulnerability only affects virtual machines created with vm-builder under...
CVE-2001-1436
Dallas Semiconductor iButton DS1991 returns predictable values when given an incorrect password, which makes it easier for users with physical access to conduct dictionary attacks against the device password...
CVE-2002-0226: Undefined Security Weakness
retrievepassword.pl in DCForum 6.x and 2000 generates predictable new passwords based on a sessionID, which allows remote attackers to request a new password on behalf of another user and use the sessionID to calculate the new password for that user...
Несанкционированный доступ в DCForum (unauthorized access)
Предсказуемый механизм генерации новго пароля...
And another (same) bug in DCForum at user registration process (dcscripts.com)
When registering a user and not allowing him to choose a password, a password is generated by the same algorithm as the algorithm used when creating new password for a user who lost it. Once again, the password is predictable, thus bypasses all limitations of using a valid mailbox for user...