Moxa EDR-810 Weak Password Vulnerability

The Moxa EDR-810 is an industrial security router with firewall/NAT/VPN and managed Layer 2 switch functionality. It is designed for Ethernet-based security applications in remote control or monitoring networks. A weak password vulnerability exists in the web server functionality of the Moxa...

Sophos Endpoint Protection Control Panel 10.7 - Weak Password Encryption

Sophos Endpoint Protection Control Panel 10.7 - Weak Password Encryption + Credits: John Page aka hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/SOPHOS-ENDPOINT-PROTECTION-CONTROL-PANEL-v10.7-INSECURE-CRYPTO-CVE-2018-9233.txt + ISR: Apparition...

Default credentials

The GSKit IBM Spectrum Protect 7.1 and 7.2 and IBM Spectrum Protect Snapshot 4.1.3, 4.1.4, and 4.1.6 CMS KDB logic fails to salt the hash function resulting in weaker than expected protection of passwords. A weak password may be recovered. Note: After update the customer should change password to...

PT-2018-12539

Name of the Vulnerable Software and Affected Versions IBM Spectrum Protect versions 7.1 through 7.2 IBM Spectrum Protect Snapshot versions 4.1.3, 4.1.4, 4.1.6 Description The GSKit CMS KDB logic fails to salt the hash function, resulting in weaker than expected protection of passwords. This...

CVE-2018-1447: Use of Password Hash With Insufficient Computational Effort

The GSKit IBM Spectrum Protect 7.1 and 7.2 and IBM Spectrum Protect Snapshot 4.1.3, 4.1.4, and 4.1.6 CMS KDB logic fails to salt the hash function resulting in weaker than expected protection of passwords. A weak password may be recovered. Note: After update the customer should change password to...

HashiCorp Terraform Amazon Web Services provider fixed password generation vulnerability

HashiCorp Terraform Amazon Web Services AWS provider is a program for interacting with AWS supported resources. A security vulnerability exists in the aws/resourceawsiamuserloginprofile.go file in HashiCorp Terraform AWS provider version 1.12.0 and earlier. A remote attacker can exploit this...

Design/Logic Flaw

aws/resourceawsiamuserloginprofile.go in the HashiCorp Terraform Amazon Web Services AWS provider through v1.12.0 has an inappropriate PRNG algorithm and seeding, which makes it easier for remote attackers to obtain access by leveraging an IAM account that was provisioned with a weak password...

CVE-2018-9057

aws/resourceawsiamuserloginprofile.go in the HashiCorp Terraform Amazon Web Services AWS provider through v1.12.0 has an inappropriate PRNG algorithm and seeding, which makes it easier for remote attackers to obtain access by leveraging an IAM account that was provisioned with a weak password...

CVE-2018-9057

aws/resourceawsiamuserloginprofile.go in the HashiCorp Terraform Amazon Web Services AWS provider through v1.12.0 has an inappropriate PRNG algorithm and seeding, which makes it easier for remote attackers to obtain access by leveraging an IAM account that was provisioned with a weak password...

CVE-2018-9057

aws/resourceawsiamuserloginprofile.go in the HashiCorp Terraform Amazon Web Services AWS provider through v1.12.0 has an inappropriate PRNG algorithm and seeding, which makes it easier for remote attackers to obtain access by leveraging an IAM account that was provisioned with a weak password...

CVE-2018-9057

aws/resourceawsiamuserloginprofile.go in the HashiCorp Terraform Amazon Web Services AWS provider through v1.12.0 has an inappropriate PRNG algorithm and seeding, which makes it easier for remote attackers to obtain access by leveraging an IAM account that was provisioned with a weak password...

CVE-2018-9057: Insufficient Entropy in PRNG

aws/resourceawsiamuserloginprofile.go in the HashiCorp Terraform Amazon Web Services AWS provider through v1.12.0 has an inappropriate PRNG algorithm and seeding, which makes it easier for remote attackers to obtain access by leveraging an IAM account that was provisioned with a weak password...

PT-2018-12383

Name of the Vulnerable Software and Affected Versions IBM GSKit IBM DB2 for Linux, UNIX and Windows versions 9.7 through 11.1 Description The issue concerns a local denial of service through environment variable overflows and a weakness in the GSKit CMS KDB logic. This logic fails to properly sal...

PT-2018-17468

Name of the Vulnerable Software and Affected Versions Foxconn femtocell FEMTO AP-FC4064-T version AP GT B38 5.8.3lb15-W47 LTE Build 15 Description A default weak password in a privileged account can be exploited to enable the TELNET service through the web interface, allowing root login without a...

CVE-2018-6312: Weak Password Requirements

A privileged account with a weak default password on the Foxconn femtocell FEMTO AP-FC4064-T version APGTB385.8.3lb15-W47 LTE Build 15 can be used to turn on the TELNET service via the web interface, which allows root login without any password. This vulnerability will lead to full system...

IBM Security Guardium Big Data Intelligence Weak Password Policy Vulnerability

IBM Security Guardium Big Data Intelligence SonarG is a suite of big data security intelligence solutions from IBM, USA. The solution features interactive data exploration, automated connectivity analysis, and user activity analysis. A security vulnerability exists in IBM Security Guardium Big Da...

CVE-2018-1372: Weak Password Requirements

IBM Security Guardium Big Data Intelligence SonarG 3.1 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. IBM X-Force ID: 137772...

Weak Password Vulnerability in iClock Series Data Services of Zhongguancun Attendance Management System

Ltd. is the sales and service organization in Shanghai of the famous biometrics and RFID products provider, China Control Technology. A weak password vulnerability exists in the iClock series of data services of the Time and Attendance Management System TAMS, which can be exploited by attackers t...

PT-2018-12248

Name of the Vulnerable Software and Affected Versions GSKit V7 GSKit affected versions not specified Description The issue may disclose side channel information via discrepancies between valid and invalid PKCS1 padding. Additionally, the GSKit CMS KDB logic fails to salt the hash function,...

Weak password, arbitrary file download vulnerability in Byzoro PatrolFlow-AM series security gateway

PatrolFlow-AM series products are high-performance application-delivery Internet behavior management devices launched by Byzoro Networks to meet the needs of Internet access users in the areas of information content security, regulation of online behavior, utilization of network resources,...