CVE-2016-5997

Summary of CVE-2016-5997 (IBM Tealeaf CX portal): The web portal in IBM Tealeaf Customer Experience versions prior to certain FP levels does not apply password-quality rules to password changes, making remote brute-force access easier. Affected products include IBM Tealeaf CX portals before 8.7.1...

CVE-2016-2999

CVE-2016-2999 affects IBM Connections 4.x through 4.5 CR5, 5.0 before CR4, and 5.5 before CR1. The issue is described as an information disclosure via an unspecified brute-force attack accessible to remote authenticated users. The available documents do not provide concrete technical details abou...

Researchers Find 'Severe' Security Hole in iOS 10 Backup

UPDATE A computer forensics firm says Apple weakened backup security protection with the Sept. 13 release of iOS 10, making it simple work for hackers to crack password protection used for backups of iOS devices stored on Macs and PCs. Elcomsoft, which explained the security hole in a blog post...

CVE-2016-6340

The kickstart file in Red Hat QuickStart Cloud Installer QCI forces use of MD5 passwords on deployed systems, which makes it easier for attackers to determine cleartext passwords via a brute-force attack...

CVE-2016-6340

CVE-2016-6340 affects Red Hat QuickStart Cloud Installer (QCI): the kickstart file forces MD5 passwords on deployed systems, enabling brute-force recovery of cleartext passwords. This is described by NVD as high-impact (CVSS3 base 8.4) with local attacker access and strong confidentiality/integri...

The vulnerability of the Windows operating system, which allows a hacker to crack the password

The vulnerability of the Windows operating system is related to incorrect checking of NTLM SSO requests for MSAs. Exploiting this vulnerability allows a malicious actor to select a password by using brute-force attacks on NTLM password hashes...

Microsoft Windows Information Disclosure Vulnerability (CNVD-2016-07749)

Microsoft Windows is a series of operating systems released by the American company Microsoft. Microsoft Windows suffers from an information disclosure vulnerability. An attacker can exploit this vulnerability to brute-force break a user's NTLM password hash...

CVE-2016-0922

Affected product: EMC ViPR SRM (before 3.7.2). Issue: failure to limit password-authentication attempts, enabling brute-force guessing from remote attackers. Root cause/impact: lack of rate-limiting on authentication leads to potential unauthorized access; integrity and availability are not direc...

CVE-2016-6825

Huawei XH620 V3, XH622 V3, and XH628 V3 servers with software before V100R003C00SPC610, RH1288 V3 servers with software before V100R003C00SPC613, RH2288 V3 servers with software before V100R003C00SPC617, and RH2288H V3 servers with software before V100R003C00SPC515 allow remote attackers to obtai...

CVE-2016-6825

The CVE covers Huawei server families (XH620/V3, XH622/V3, XH628/V3 before specific SPC builds; RH1288V3 before SPC613; RH2288V3 before SPC617; RH2288H V3 before SPC515) where lack of authentication protection enables brute-force password retrieval via remote access. This reflects a remote-authen...

Yelp: Verification of E-Mail address possible on https://biz.yelp.com/login and https://biz.yelp.com/forgot

On pages https://biz.yelp.com/login and https://biz.yelp.com/forgot a malicious user can verify if a particular E-mail address is registered on biz.yelp.com. Steps to reproduce for https://biz.yelp.com/login: 1. Open https://biz.yelp.com/login 2. Enter non existing E-Mail Address 3. Enter any...

CVE-2016-6340

The kickstart file in Red Hat QuickStart Cloud Installer QCI forces use of MD5 passwords on deployed systems, which makes it easier for attackers to determine cleartext passwords via a brute-force attack...

CVE-2016-5799

Moxa OnCell G3100V2 devices before 2.8 and G3111, G3151, G3211, and G3251 devices before 1.7 do not properly restrict authentication attempts, which makes it easier for remote attackers to obtain access via a brute-force attack...

Instacart: Brute force login and bypass locked account restrictions via iOS app

When logging in to an account on the website, a user's account gets locked out after 15 tries to prevent an attacker from brute forcing access to the account. These same restrictions do not apply to the mobile sign-in endpoint a POST request to https://www.instacart.com/oauth/token, which allows ...

CVE-2016-6144

The SQL interface in SAP HANA before Revision 102 does not limit the number of login attempts for the SYSTEM user when the passwordlockforsystemuser is not supported or is configured as "False," which makes it easier for remote attackers to bypass authentication via a brute force attack, aka SAP...

CVE-2016-6144

SAP HANA SQL interface vulnerability CVE-2016-6144 affects SAP HANA versions prior to Revision 102, where login attempts for SYSTEM are not rate-limited when password_lock_for_system_user is unsupported or false, enabling brute-force authentication bypass. Impact: remote attacker could bypass aut...

F5 Networks BIG-IP : NTP vulnerability (SOL15935)

util/ntp-keygen.c in ntp-keygen in NTP before 4.2.7p230 uses a weak RNG seed, which makes it easier for remote attackers to defeat cryptographic protection mechanisms via a brute-force attack. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted...

Ian Dunn: Brute force on wp-login

A common threat web developers face is a password-guessing attack known as a brute force attack. A brute-force attack is an attempt to discover a password by systematically trying every possible combination of letters, numbers, and symbols until you discover the one correct combination that works...

CVE-2016-0391

The IBM Watson Developer Cloud services on Bluemix platforms do not properly generate random numbers for service-instance credentials, which makes it easier for remote attackers to defeat cryptographic protection mechanisms via a brute-force attack...

CVE-2016-0391

CVE-2016-0391 detail (IBM Watson Bluemix) Affected: IBM Watson Developer Cloud services on Bluemix (e.g., Concept Expansion, Concept Insights, Dialog, Document Conversion, Language Translation, Natural Language Classifier, Personality Insights, Relationship Extraction, Retrieve and Rank, Speech t...