USN-3061-1 openssh vulnerabilities

Eddie Harari discovered that OpenSSH incorrectly handled password hashing when authenticating non-existing users. A remote attacker could perform a timing attack and enumerate valid users. CVE-2016-6210 Tomas Kuthan, Andres Rojas, and Javier Nieto discovered that OpenSSH did not limit password...

SAP HANA User Enumeration Vulnerability

SAP HANA is a high-performance real-time data analytics platform from SAP. The platform provides data query functions, users can directly query and analyze a large amount of real-time business data. A user enumeration vulnerability exists in the SQL interface in SAP HANA. A remote attacker could...

CVE-2016-6145

The SQL interface in SAP HANA DB 1.00.091.00.1418659308 provides different error messages for failed login attempts depending on whether the username exists and is locked when the detailederroronconnect option is not supported or is configured as "False," which allows remote attackers to enumerat...

PT-2016-6769

Name of the Vulnerable Software and Affected Versions SAP HANA DB version 1.00.091.00.1418659308 Description The issue concerns the SQL interface in SAP HANA DB, where it provides different error messages for failed login attempts depending on whether the username exists and is locked when the...

CVE-2016-6145: Exposure of Sensitive Information to an Unauthorized Actor

The SQL interface in SAP HANA DB 1.00.091.00.1418659308 provides different error messages for failed login attempts depending on whether the username exists and is locked when the detailederroronconnect option is not supported or is configured as "False," which allows remote attackers to enumerat...

ntop-ng 2.5.160805 - Username Enumeration

ntop-ng 2.5.160805 - Username Enumeration Exploit title: ntopng user enumeration Author: Dolev Farhi Contact: dolevf at protonmail.com Date: 04-08-2016 Vendor homepage: ntop.org Software version: v.2.5.160805 !/usr/env/python import os import sys import urllib import urllib2 import cookielib serv...

Debian Security Advisory DSA 3626-1 (openssh - security update)

Eddie Harari reported that the OpenSSH SSH daemon allows user enumeration through timing differences when trying to authenticate users. When sshd tries to authenticate a non-existing user, it will pick up a fixed fake password structure with a hash based on the Blowfish algorithm. If real users...

Debian: Security Advisory (DSA-3626-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Debian DLA-578-1 : openssh security update

OpenSSH secure shell client and server had a user enumeration problem reported. CVE-2016-6210 User enumeration via covert timing channel For Debian 7 'Wheezy', this problem has been fixed in version 6.0p1-4+deb7u5. We recommend that you upgrade your openssh packages. NOTE: Tenable Network Securit...

Uber: User Enumeration and Information Disclosure

Vulnerability Name: User Enumeration and Information Disclosure Description: It was possible to enumerate users for SquareSpace admin console in uber-movement. Please find below details of users enumerated: 1. [email protected] 2. [email protected] Information Disclosure in...

[SECURITY] [DLA 578-1] openssh security update

Package : openssh Version : 6.0p1-4+deb7u5 CVE ID : CVE-2016-6210 OpenSSH secure shell client and server had a user enumeration problem reported. CVE-2016-6210 User enumeration via covert timing channel For Debian 7 "Wheezy", this problem has been fixed in version 6.0p1-4+deb7u5. We recommend tha...

OpenSSH User Enumeration Vulnerability

OpenSSH OpenBSD Secure Shell is a set of connection tools maintained by the OpenBSD Project Group for secure access to remote computers. A user enumeration vulnerability exists in OpenSSH.The OpenSSH SSH daemon allows for user enumeration with a time lag in user authentication...

Debian DSA-3626-1 : openssh - security update

Eddie Harari reported that the OpenSSH SSH daemon allows user enumeration through timing differences when trying to authenticate users. When sshd tries to authenticate a non-existing user, it will pick up a fixed fake password structure with a hash based on the Blowfish algorithm. If real users...

[SECURITY] [DSA 3626-1] openssh security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3626-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso July 24, 2016 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3626-1] openssh security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3626-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso July 24, 2016 https://www.debian.org/security/faq -...

DSA-3626-1 openssh - security update

Bulletin has no description...

Multiple Vulnerabilities in ZOHO ManageEngine Password Manager Pro

ZOHO ManageEngine Password Manager Pro PMP is a set of U.S. ZOHO ZOHO password management software. ZOHO ManageEngine PMP suffers from HTML injection, user enumeration, cross-site request forgery, power lifting, security bypass, and authentication bypass vulnerabilities. An attacker can exploit...

Multiple vulnerabilities in Drupal REST JSON module

Drupal is a free and open source content management system developed in PHP and maintained by the Drupal community.REST JSON is one of the interface modules used to expose Drupal content. The Drupal REST JSON module version 7.x-1.x has a 1. security bypass vulnerability 2. user enumeration...

OpenSSHD 7.2p2 User Enumeration

!/usr/bin/python CVEs: CVE-2016-6210 Credits for this go to Eddie Harari Author: 0o -- nullnull nu11.nu11 at yahoo.com Oh, and it is n-u-one-one.n-u-one-one, no l's... Wonder how the guys at packet storm could get this wrong : Date: 2016-07-19 Purpose: User name enumeration against SSH daemons...

OpenSSHD user enumeration vulnerability-vulnerability warning-the black bar safety net

! Summary: By sending a long password,a remote user can enumerate on the system running the SSHD user. This problem exists in most of the modern configuration,as compared to the calculation of BLOWFISH hashes,takes longer time to calculate the SHA256 / SHA512 to. CVE-ID:CVE-2 0 1 6-6 2 1 0 Test...