2930 matches found
MySQL 3.x/4.0.x Weak Password Encryption Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/7500/info MySQL has been reported to implement a weak password encryption algorithm. It has been reported that the MySQL function used to encrypt MySQL passwords makes just one pass over the password and employs a weak le...
NetWin DMail 2.x,SurgeFTP 1.0/2.0 Weak Password Encryption Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/3075/info The Netwin Authentication module, or NWAuth, is an external authentication module used by several Netwin products. A simple one-way hash function is used by NWAuth to perform password encryption operations. As a...
IBM Net.Commerce 3.1/3.2 WebSphere Weak Password Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/2482/info Versions of IBM NetCommerce and WebSphere Commerce Suite ecommerce packages employ weak password encryption for their users' and administrators' passwords. This encryption is defeatable using a widely-published...
iBill Management Script Weak Hard-Coded Password Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/3476/info iBill is an Internet billing company that provides secure payment processing for e-commerce. A vulnerability exists in iBill's CGI password management script called ibillpm.pl. The default password is the client...
Mailtraq 2.1 .0.1302 User Password Encoding Weakness
No description provided by source. source: http://www.securityfocus.com/bid/7923/info It has been reported that Mailtraq does not securely store passwords. Because of this, an attacker may have an increased chance at gaining access to clear text passwords. !/usr/bin/perl $Password = $ARGV0; print...
Ipswitch IMail 5.0/5.0.5/5.0.6/5.0.7/5.0.8/6.0 Weak Password Encryption Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/880/info IMail keeps the encrypted passwords for email accounts in a registry key, HKLM\SOFTWARE\Ipswitch\Imail\Domains\DomainName\Users\UserName, in a string value called Password. The encryption scheme used is weak and...
Default Password (arkeia) for 'root' Account
The account 'root' on the remote host has the password 'arkeia'. An attacker may leverage this issue to gain administrative access to the affected system. Note that Western Digital Arkeia is known to use these credentials to provide complete, administrative access to the virtual appliance...
TurboMail 弱密码漏洞
TurboMail邮箱系统安装后 默认会有4个root域的账号，管理员及三个普通账号：postmaster管理员nobodysecbmsecsj默认密码为空漏洞利用过程http://xxx.com/mailmain?type=login&uid=secbm&pwd=&domain=root&style=enterprisehttp://xxx.com/mailmain?type=login&uid= postmaster&pwd=&domain=root&style=enterprisehttp://xxx.com/mailmain?type=login&uid=...
jdmail 弱密码漏洞
JinDiMail邮箱系统是TurboMail基础上二次开发安装后 默认会有4个root域的账号，管理员及三个普通账号：postmaster管理员nobodysecbmsecsj默认密码为空漏洞利用过程http://xxx.com/mailmain?type=login&uid=secbm&pwd=&domain=root&style=enterprisehttp://xxx.com/mailmain?type=login&uid=...
WPScan - WordPress Security Scanner
WPScan is a black box WordPress vulnerability scanner. Features Username enumeration from author querystring and location header Weak password cracking multithreaded Version enumeration from generator meta tag and from client side files Vulnerability enumeration based on version Plugin enumeratio...
某通用CRM系统任意文件上传
简要描述： 某通用CRM系统任意文件上传 详细说明： 用友旗下的畅捷通CRM http://www.chanjet.com/bencandy.php?fid=41&id=185 如图 存在任意文件上传，我们到官方demo站，crm.chanjet.com,发现弱口令 test 111111，成功登入 选择产品，看到附件 我们来新建一个附件，直接上传1.php，上传成功，我们来访问下， 上传后缀成了php.bak，由于官方使用apache搭建的，存在解析漏洞，所以这个是可以get...
Turbomail认证信息设计缺陷及存储型xss
简要描述： 漏洞1、任意用户认证信息劫持 漏洞2、跨站 漏洞3、内置账号弱口令 详细说明： 1、邮件系统直接把用户sessionid放置于url中，导致可利用图片探针轻易窃取到用户sessionid。 2、跨站漏洞，主要还是编辑器。 3、内置账号nobody默认口令为空，直接拿nobody搞到通讯录，然后就可以爆破其他人邮箱了，或者直接利用问题1劫持。 漏洞证明： 1、将图片探针插入到qq邮箱或其他邮箱img标签中发送给需要劫持的邮箱 对方在收到邮件阅读邮件时触发包含在邮件中的图片探针，手机第一时间收到包含sessionid的url...
CVE-2013-0173
Foreman before version 1.1 uses a fixed salt named “foreman” to hash root passwords, making brute-force guessing easier. The vulnerability affects the password-hashing path in Foreman pre-1.1; the root credential protection is weakened due to the non-unique, predictable salt. The available source...
CVE-2013-0173
Foreman before 1.1 uses a salt of "foreman" to hash root passwords, which makes it easier for attackers to guess the password via a brute force attack...
齐博官方后台存在弱口令问题（20多万会员信息危险）
简要描述： 后台弱口令 详细说明： http://www.qibosoft.com/admin28319635 http://bbs.qibosoft.com/admin.php 后台登陆地址 漏洞证明： Username:龙城 Password:020php168 没备份任何数据与没删除任何数据...
管理后台 弱密码漏洞
No description provided by source...
ZTE OLT C300 弱密码漏洞
No description provided by source...
SNMP 弱密码漏洞
No description provided by source...
CVE-2014-1696
Siemens SIMATIC WinCC OA before 3.12 P002 uses a weak password hash in the server application, enabling remote brute-force access. Affected: SIMATIC WinCC OA server (prior to 3.12 P002 January). Impact: potential privilege escalation or unauthorized access as described in the ICS advisory. Remedi...