CVE-2014-6078: Improper Access Control

IBM Security Access Manager for Mobile 8.x before 8.0.1 and Security Access Manager for Web 7.x before 7.0.0 FP10 and 8.x before 8.0.1 do not have a lockout period after invalid login attempts, which makes it easier for remote attackers to obtain admin access via a brute-force attack...

CVE-2014-9248

Zenoss Core through 5 Beta 3 does not require complex passwords, which makes it easier for remote attackers to obtain access via a brute-force attack, aka ZEN-15406...

Cross site scripting

Zenoss Core through 5 Beta 3 does not require complex passwords, which makes it easier for remote attackers to obtain access via a brute-force attack, aka ZEN-15406...

Cross site scripting

Zenoss Core through 5 Beta 3 uses a weak algorithm to hash passwords, which makes it easier for context-dependent attackers to obtain cleartext values via a brute-force attack on hash values in the database, aka ZEN-15413...

CVE-2014-9248

CVE-2014-9248 affects Zenoss Core up to 5 Beta 3, with no password complexity requirements, enabling potential remote brute-force access. The issue is tied to the authentication policy, not a specific code path in isolation. The public materials indicate mitigation by applying Zenoss Core 4.2.5 S...

PT-2014-8905

Name of the Vulnerable Software and Affected Versions Zenoss Core versions through 5 Beta 3 Description The issue makes it easier for attackers to obtain cleartext password values via a brute-force attack on hash values in the database, due to the use of a weak algorithm to hash passwords...

PT-2014-8902

Name of the Vulnerable Software and Affected Versions Zenoss Core versions through 5 Beta 3 Description The issue allows remote attackers to obtain access via a brute-force attack because it does not require complex passwords. Recommendations For versions through 5 Beta 3, consider implementing a...

CVE-2014-9251: Undefined Security Weakness

Zenoss Core through 5 Beta 3 uses a weak algorithm to hash passwords, which makes it easier for context-dependent attackers to obtain cleartext values via a brute-force attack on hash values in the database, aka ZEN-15413...

CVE-2014-9248: Undefined Security Weakness

Zenoss Core through 5 Beta 3 does not require complex passwords, which makes it easier for remote attackers to obtain access via a brute-force attack, aka ZEN-15406...

Session fixation

Digicom DG-5514T ADSL router with firmware 3.2 generates predictable session IDs, which allows remote attackers to gain administrator privileges via a brute force session hijacking attack...

Code injection

IBM Java Runtime Environment JRE 7 R1 before SR1 FP1 7.1.1.1, 7 before SR7 FP1 7.0.7.1, 6 R1 before SR8 FP1 6.1.8.1, 6 before SR16 FP1 6.0.16.1, and before 5.0 SR16 FP7 5.0.16.7 allows attackers to obtain the private key from a Certificate Management System CMS keystore via a brute force attack...

CVE-2014-3068

IBM Java Runtime Environment JRE 7 R1 before SR1 FP1 7.1.1.1, 7 before SR7 FP1 7.0.7.1, 6 R1 before SR8 FP1 6.1.8.1, 6 before SR16 FP1 6.0.16.1, and before 5.0 SR16 FP7 5.0.16.7 allows attackers to obtain the private key from a Certificate Management System CMS keystore via a brute force attack...

CVE-2014-3068: Undefined Security Weakness

IBM Java Runtime Environment JRE 7 R1 before SR1 FP1 7.1.1.1, 7 before SR7 FP1 7.0.7.1, 6 R1 before SR8 FP1 6.1.8.1, 6 before SR16 FP1 6.0.16.1, and before 5.0 SR16 FP7 5.0.16.7 allows attackers to obtain the private key from a Certificate Management System CMS keystore via a brute force attack...

Default credentials

The userresourcecreate function in the Services module 7.x-3.x before 7.x-3.10 for Drupal uses a password of 1 when creating new user accounts, which makes it easier for remote attackers to guess the password via a brute force attack...

CVE-2014-9151

The Services module 7.x-3.x before 7.x-3.10 for Drupal does not properly limit the rate of authentication attempts, which makes it easier for remote attackers to obtain access via a brute-force attack on the administrative password...

CVE-2014-9152

CVE-2014-9152 affects the Drupal Services module (7.x-3.x) prior to 7.x-3.10. The _user_resource_create function creates new user accounts with a password of 1, enabling remote attackers to brute-force the password. Impact is partial confidentiality and integrity risk for newly created accounts; ...

CVE-2014-9152

The userresourcecreate function in the Services module 7.x-3.x before 7.x-3.10 for Drupal uses a password of 1 when creating new user accounts, which makes it easier for remote attackers to guess the password via a brute force attack...

PT-2014-8851

Name of the Vulnerable Software and Affected Versions Drupal Services module versions 7.x-3.x before 7.x-3.10 Description The issue allows remote attackers to gain access through a brute-force attack on the administrative password due to improper rate limiting of authentication attempts...

CVE-2014-9152: Undefined Security Weakness

The userresourcecreate function in the Services module 7.x-3.x before 7.x-3.10 for Drupal uses a password of 1 when creating new user accounts, which makes it easier for remote attackers to guess the password via a brute force attack...

CVE-2014-9151: Improper Access Control

The Services module 7.x-3.x before 7.x-3.10 for Drupal does not properly limit the rate of authentication attempts, which makes it easier for remote attackers to obtain access via a brute-force attack on the administrative password...