OpenSSH w/ PAM Multiple Timing Attack Weaknesses

The remote host seems to be running an SSH server that could allow an attacker to determine the existence of a given login by comparing the time the remote sshd daemon takes to refuse a bad password for a nonexistent login compared to the time it takes to refuse a bad password for a valid login. ...

Check Point FireWall-1 Open Web Administration

The remote Check Point FireWall is open to Web administration. An attacker can use it to launch a brute-force password attack against the firewall, and eventually take control of it. This script was written by Matthew North Checks to see if remote Check Point FireWall is open to Web administratio...

CVE-2002-0394

Red-M 1050 Bluetooth Access Point uses case insensitive passwords, which makes it easier for attackers to conduct a brute force guessing attack due to the smaller space of possible passwords...

CVE-2001-1291

The telnet server for 3Com hardware such as PS40 SuperStack II does not delay or disconnect remote attackers who provide an incorrect username or password, which makes it easier to break into the server via brute force password guessing...

CVS pserver Brute Force Access

It was possible to find the public CVS repository of the remote host by searching a list of commonly used passwords and CVS repositories. A remote attacker could exploit this to access or modify sensitive information. C Tenable Network Security, Inc. include"compat.inc"; ifdescription...

SSH1 SSH Daemon Logging Failure

The remote host is running SSH Communications Security SSH 1.2.30 or older. The remote version of this software does not log repeated login attempts, which could allow remote attackers to compromise accounts without detection via a brute-force attack. This script was written by Xue Yong Zhi See t...

FreeBSD-SA-03:03.syncookies

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ============================================================================= FreeBSD-SA-03:03.syncookies Security Advisory The FreeBSD Project Topic: Brute force attack on SYN cookies Category: core Module: sysnetinet Announced: 2003-02-24 Credits:...

CVE-2002-0628

The Telnet service for Polycom ViewStation before 7.2.4 does not restrict the number of failed login attempts, which makes it easier for remote attackers to guess usernames and passwords via a brute force attack...

CVE-2002-0628

The Telnet service for Polycom ViewStation before 7.2.4 does not restrict the number of failed login attempts, which makes it easier for remote attackers to guess usernames and passwords via a brute force attack...

CVE-2002-0628

The issue affects Polycom ViewStation Telnet service prior to version 7.2.4. The Telnet implementation does not restrict failed login attempts, enabling brute‑force guesses of usernames and passwords. Impact is described as remote authentication bypass via brute force. A fix is available: upgrade...

CVE-2002-2014

Lotus Domino 5.0.8 web server returns different error messages when a valid or invalid user is provided in HTTP requests, which allows remote attackers to determine valid user names and makes it easier to conduct brute force attacks...

CVE-2002-1657

PostgreSQL uses the username for a salt when generating passwords, which makes it easier for remote attackers to guess passwords via a brute force attack...

CVE-2002-2028

The screensaver on Windows NT 4.0, 2000, XP, and 2002 does not verify if a domain account has already been locked when a valid password is provided, which makes it easier for users with physical access to conduct brute force password guessing...

CVE-2002-1374

The COMCHANGEUSER command in MySQL 3.x before 3.23.54, and 4.x before 4.0.6, allows remote attackers to gain privileges via a brute force attack using a one-character password, which causes MySQL to only compare the provided password against the first character of the real password...

Citrix Published Applications - Information Disclosure

Citrix Published Applications - Information Disclosure source: https://www.securityfocus.com/bid/5908/info A vulnerability has been discovered in Citrix. It is possible for an attacker to obtain information regarding Published Applications, by sending specially crafted requests to the Citrix...

CVE-2002-0954

The encryption algorithms for enable and passwd commands on Cisco PIX Firewall can be executed quickly due to a limited number of rounds, which make it easier for an attacker to decrypt the passwords using brute force techniques...

CVE-2002-0903

register.php for WoltLab Burning Board wbboard 1.1.1 uses a small number of random values for the "code" parameter that is provided to action.php to approve a new registration, along with predictable new user ID's, which allows remote attackers to hijack new user accounts via a brute force attack...

CVE-2002-0903

WoltLab Burning Board (wbboard) 1.1.1 is affected. The register.php flow uses a small set of random values for the code parameter passed to action.php to approve registrations, together with predictable new user IDs, enabling remote attackers to hijack new user accounts through brute-forcing the ...

CVE-2002-0394

Red-M 1050 Bluetooth Access Point uses case insensitive passwords, which makes it easier for attackers to conduct a brute force guessing attack due to the smaller space of possible passwords...

CVE-2002-0583

WorkforceROI Xpede 4.1 uses a small random namespace 5 alphanumeric characters for temporary expense claim reports in the /reports/temp directory, which allows remote attackers to read the reports via a brute force attack...