Code injection

The ssl3clienthello function in s3clnt.c in OpenSSL 1.0.2 before 1.0.2a does not ensure that the PRNG is seeded before proceeding with a handshake, which makes it easier for remote attackers to defeat cryptographic protection mechanisms by sniffing the network and then conducting a brute-force...

CVE-2015-0285

The ssl3clienthello function in s3clnt.c in OpenSSL 1.0.2 before 1.0.2a does not ensure that the PRNG is seeded before proceeding with a handshake, which makes it easier for remote attackers to defeat cryptographic protection mechanisms by sniffing the network and then conducting a brute-force...

CVE-2015-0285

CVE-2015-0285: OpenSSL could seed PRNG insecurely in ssl3_client_hello, enabling weaker handshake security. IBM advisories for DataPower, Rational, and SAN/BladeCenter products list mitigations via updates to fixed OpenSSL versions (e.g., IBM DataPower fixes 6.0.x+/7.0.x+; IBM i/Data ONTAP notes)...

CVE-2014-9687

eCryptfs 104 and earlier uses a default salt to encrypt the mount passphrase, which makes it easier for attackers to obtain user passwords via a brute force attack...

CVE-2014-9687

eCryptfs 104 and earlier uses a default salt to encrypt the mount passphrase, which makes it easier for attackers to obtain user passwords via a brute force attack...

DEBIAN-CVE-2014-9687

eCryptfs 104 and earlier uses a default salt to encrypt the mount passphrase, which makes it easier for attackers to obtain user passwords via a brute force attack...

CVE-2014-9687

CVE-2014-9687 affects the Linux eCryptfs utilities (ecryptfs-utils), specifically “ecryptfs-utils 104 and earlier.” The root cause is the use of a default salt to wrap the mount passphrase, which increases the effectiveness of offline brute-force password attacks. Documents in connected sources c...

CVE-2015-0886

Integer overflow in the cryptraw method in the key-stretching implementation in jBCrypt before 0.4 makes it easier for remote attackers to determine cleartext values of password hashes via a brute-force attack against hashes associated with the maximum exponent...

CVE-2015-0886

Integer overflow in the cryptraw method in the key-stretching implementation in jBCrypt before 0.4 makes it easier for remote attackers to determine cleartext values of password hashes via a brute-force attack against hashes associated with the maximum exponent...

Integer overflow

Integer overflow in the cryptraw method in the key-stretching implementation in jBCrypt before 0.4 makes it easier for remote attackers to determine cleartext values of password hashes via a brute-force attack against hashes associated with the maximum exponent...

CVE-2015-0886

Integer overflow in the cryptraw method in the key-stretching implementation in jBCrypt before 0.4 makes it easier for remote attackers to determine cleartext values of password hashes via a brute-force attack against hashes associated with the maximum exponent...

CVE-2015-0886

Integer overflow in the cryptraw method in the key-stretching implementation in jBCrypt before 0.4 makes it easier for remote attackers to determine cleartext values of password hashes via a brute-force attack against hashes associated with the maximum exponent...

CVE-2015-0886

Integer overflow in the cryptraw method in the key-stretching implementation in jBCrypt before 0.4 makes it easier for remote attackers to determine cleartext values of password hashes via a brute-force attack against hashes associated with the maximum exponent...

Code injection

The WebRTC subsystem in Mozilla Firefox before 36.0 recognizes turns: and stuns: URIs but accesses the TURN or STUN server without using TLS, which makes it easier for man-in-the-middle attackers to discover credentials by spoofing a server and completing a brute-force attack within a short time...

Linux Kernel ASLR Implementation Insufficient Moisture Vulnerability

Linux Kernel is an open source operating system. The Linux Kernel ALSR implementation suffers from an insufficient moisture problem that allows attackers to exploit vulnerabilities to bypass security restrictions through brute force techniques for further attacks...

CVE-2015-1355

Siemens SIMATIC STEP 7 TIA Portal before 13 SP1 uses a weak password-hash algorithm, which makes it easier for local users to determine cleartext passwords by reading a project file and conducting a brute-force attack...

CVE-2015-1355

Siemens SIMATIC STEP 7 TIA Portal before 13 SP1 uses a weak password-hash algorithm, which makes it easier for local users to determine cleartext passwords by reading a project file and conducting a brute-force attack...

AIX 7.1 TL 3 : ntp (IV68430)

The version of NTP installed on the remote AIX host is affected by the following vulnerabilities : - A security weakness exists due to the configauth function improperly generating default keys when no authentication key is defined in the ntp.conf file. Key size is limited to 31 bits and the...

FancyFon FAMOC Cryptographic Hash Algorithm Vulnerability

FancyFon FAMOC is a mobile device management platform. FancyFon FAMOC suffers from a password hashing algorithm vulnerability that can be exploited by an attacker to conduct a brute force attack and obtain a user's password...

SUSE-SU-2015:0274-1 Security update for ntp

ntp was updated to fix four security issues. These security issues were fixed: - CVE-2014-9294: util/ntp-keygen.c in ntp-keygen used a weak RNG seed, which made it easier for remote attackers to defeat cryptographic protection mechanisms via a brute-force attack bnc910764 911792. - CVE-2014-9293:...