CVE-2011-4898

wp-admin/setup-config.php in the installation component in WordPress 3.3.1 and earlier generates different error messages for requests lacking a dbname parameter depending on whether the MySQL credentials are valid, which makes it easier for remote attackers to conduct brute-force attacks via a...

Design/Logic Flaw

DISPUTED wp-admin/setup-config.php in the installation component in WordPress 3.3.1 and earlier generates different error messages for requests lacking a dbname parameter depending on whether the MySQL credentials are valid, which makes it easier for remote attackers to conduct brute-force attack...

CVE-2011-4898

wp-admin/setup-config.php in the installation component in WordPress 3.3.1 and earlier generates different error messages for requests lacking a dbname parameter depending on whether the MySQL credentials are valid, which makes it easier for remote attackers to conduct brute-force attacks via a...

CVE-2012-0937

CVE-2012-0937 affects WordPress 3.3.1 and earlier, where the installation component (wp-admin/setup-config.php) does not limit the number of MySQL queries sent to external MySQL database servers via the dbhost parameter. This can allow remote attackers to use WordPress as a proxy for brute-force ...

CVE-2011-4898

CVE-2011-4898 affects WordPress 3.3.1 and earlier, in wp-admin/setup-config.php. The issue stems from different error messages returned for requests without a dbname depending on MySQL credentials, which can facilitate brute-force attempts by cycling uname/pwd across requests. The connected Nessu...

CVE-2011-4898

wp-admin/setup-config.php in the installation component in WordPress 3.3.1 and earlier generates different error messages for requests lacking a dbname parameter depending on whether the MySQL credentials are valid, which makes it easier for remote attackers to conduct brute-force attacks via a...

Vulnerabilities in D-Link DSL-500T ADSL Router

Hello 3APA3A! I want to warn you about security vulnerabilities in D-Link DSL-500T ADSL Router. These are Predictable Resource Location, Brute Force and Cross-Site Request Forgery vulnerabilities. This is my first advisory from series of advisories about vulnerabilities in D-Link products...

Cain & Abel v4.9.43 Released

Cain & Abel v4.9.43 Released Cain & Abel is a password recovery tool for Microsoft operating systems.It allows easy recovery of various kind of passwords by sniffing the network, cracking encrypted passwords using dictionary and brute force attacks, decoding scrambled passwords, revealing passwor...

Morto Worm spreading via Remote Desktop Protocol

Morto Worm spreading via Remote Desktop Protocol Organizations large and small often make use of Remote Desktop or Terminal Services to remotely connect to Windows computers over the Internet and internally. These tools use Microsoft's RDP protocol to allow the user to operate the remote system...

Drupal 6.22 Cross Site Scripting

------------------------- Affected products: ------------------------- Vulnerable are Drupal 6.22 and previous versions. Taking into account that developers didn't fixed these holes, then versions 7.x also must be vulnerable. ---------- Details: ---------- XSS WASC-08: At pages with forms i.e. at...

Vulnerabilities in ADSL modem Callisto 821+

Hello 3APA3A! I want to warn you about security vulnerabilities in ADSL modem Callisto 821+ SI2000 Callisto821+ Router. These are Predictable Resource Location and Brute Force vulnerabilities. Predictable Resource Location WASC-34: http://192.168.1.1 web server on 80 and 8008 ports. The control...

Asterisk 1.8.4.1 - SIP 'REGISTER' Request User Enumeration

source: https://www.securityfocus.com/bid/48008/info Asterisk is prone to a user-enumeration weakness. An attacker may leverage this issue to harvest valid usernames, which may aid in brute-force attacks. This issue affects Asterisk 1.8.4.1; other versions may also be affected. REGISTER...

EgY SpIdEr ShElL : Shell strongest in the history the hacker !

Sites get hacked every day. The bad guys often install a toolkit to control remote servers effectively. Here is one called EgY SpIdEr ShElL: When logging in, you get a quick overview of the machine with what services are running, as well as some hardware specs.: The toolkit provides you with...

LastPass Asks Users To Change Password After Probable Breach

ED: LastPass Asks Users To Change Password After Probable Breach DEK: The Web based password management firm says it detected what it thinks is a breach that could have exposed some customer passwords. LastPass, a Web based password management firm, advised its customers to change the password th...

Multiple SSH Initial Connection Requests (CVE-2003-0190; CVE-2006-5229; CVE-2016-6210)

Brute Force Attacks are a significant threat on users privacy. Using Brute Force, remote attackers attempt to gain access to unauthorized areas of a target system, such as FTP accounts, e-mail accounts and databases. By trying to repeatedly log in to an SSH server using different passwords, it is...

CVE-2010-4626

The myrand function in functions.php in MyBB aka MyBulletinBoard before 1.4.12 does not properly use the PHP mtrand function, which makes it easier for remote attackers to obtain access to an arbitrary account by requesting a reset of the account's password, and then conducting a brute-force atta...

Hackers Leverage Cloud Computing to Crack Passwords Efficiently

On-demand cloud computing is a valuable tool for companies needing temporary computing capacity without long-term investment in fixed capital. However, this same convenience makes cloud computing useful to hackers. Many hacking activities involve cracking passwords, keys, or other forms of brute...

CVE-2007-6737

FTPServer.py in pyftpdlib before 0.2.0 does not increment the attemptedlogins count for a USER command that specifies an invalid username, which makes it easier for remote attackers to obtain access via a brute-force attack...

Strong passwords

Here’s a nice tip instead. Think of a phrase that is most likely unique and easy to remember, for example, “uniqueeasytorememberphrase”. Be sure no dictionaries used in brute-force attacks include such a password. Also, after using it for several days you will start typing it faster than the blin...

Botnet Targets SSH Servers Via Brute Force

The ddssh bot is currently responsible for an increase in brute force attacks on SSH connections. Botnet herders are apparently injecting the script via a phpMyAdmin vulnerability and using the compromised computers for targeted SSH attacks. Read the full article. The H Security...