CVE-2003-1230

The implementation of SYN cookies syncookies in FreeBSD 4.5 through 5.0-RELEASE-p3 uses only 32-bit internal keys when generating syncookies, which makes it easier for remote attackers to conduct brute force ISN guessing attacks and spoof legitimate traffic...

CVE-2004-2313

Inter7 SqWebMail 3.4.1 through 3.6.1 generates different error messages for incorrect passwords versus correct passwords on non-mail-enabled accounts such as root, which allows remote attackers to guess the root password via brute force attacks...

CVE-2002-2014

Lotus Domino 5.0.8 web server returns different error messages when a valid or invalid user is provided in HTTP requests, which allows remote attackers to determine valid user names and makes it easier to conduct brute force attacks...

CVE-2002-2014

Lotus Domino 5.0.8 web server is affected by CVE-2002-2014. The vulnerability arises because the server returns different error messages for valid versus invalid user names in HTTP requests, enabling remote attackers to enumerate valid accounts and facilitate brute-force attempts. The connected s...

FreeBSD : mailman -- generated passwords are poor quality (b3cd00f7-c0c5-452d-87bc-086c5635333e)

Florian Weimer wrote : Mailman 2.1.5 uses weak auto-generated passwords for new subscribers. These passwords are assigned when members subscribe without specifying their own password either by email or the web frontend. Knowledge of this password allows an attacker to gain access to the list...

CVE-2001-1499

The CVE affects Check Point VPN-1 4.1SP4 with SecuRemote. The vulnerability arises from differing error messages for valid vs. invalid users, depending on authentication method, which can facilitate brute-force attempts. Affected component: VPN-1/SecuRemote authentication prompts. Impact: enables...

CVE-2001-0161

The CVE-2001-0161 entry concerns Cisco 340-series Aironet access points running firmware 11.01. The vulnerability arises because the device does not use 6 of the 24 available IV bits in WEP, which makes it easier for remote attackers to perform brute-force attacks. The provided documents confirm ...

CVE-2001-0161

Cisco 340-series Aironet access point using firmware 11.01 does not use 6 of the 24 available IV bits for WEP encryption, which makes it easier for remote attackers to mount brute force attacks...

Oracle Enterprise Manager Web Console Detection

The remote host appears to run Oracle Enterprise Manager; connections are allowed to the web console management. Letting attackers know that you are using this software will help them to focus their attack or will make them change their strategy. In addition to this, an attacker may attempt to se...

Aventail ASAP Platform Management Console Detection

The remote host seems to be an Aventail SSL VPN appliance, and it allows connections to its web console management. Letting attackers know that you are using such a device will help them to focus their attacks or will make them change their strategy. In addition to this, an attacker may attempt a...

CVE-2005-0797

The CVE-2005-0797 entry concerns Novell iChain Mini FTP Server 2.3, where authentication error handling reveals whether a user exists. This information disclosure can facilitate brute-force attempts, since attackers can iterate valid usernames more efficiently. The available sources confirm the a...

CVE-2005-0797

Novell iChain Mini FTP Server 2.3 displays different error messages if a user exists or not, which allows remote attackers to obtain sensitive information and facilitates brute force attacks...

CVE-2003-1096

The Cisco LEAP challenge/response authentication mechanism uses passwords in a way that is susceptible to dictionary attacks, which makes it easier for remote attackers to gain privileges via brute force password guessing attacks...

CVE-2005-0432

BEA WebLogic Server 7.0 Service Pack 5 and earlier, and 8.1 Service Pack 3 and earlier, generates different login exceptions that suggest why an authentication attempt fails, which makes it easier for remote attackers to guess passwords via brute force attacks...

Portcullis Security Advisory 05-002 Spectrum Cash Receipting System Weak Password Encryption

Portcullis Security Advisory Vulnerable System: Spectrum Cash Receipting System Vulnerability Title: Spectrum Cash Receipting System Weak Password Protection Vulnerability. Vulnerability discovery and development: Portcullis Security Testing Services. Affected systems: All known versions of...

ArGoSoft FTP Server reveals valid usernames and allows for brute force attacks

Vendor: ArGoSoft Date: December 31, 2004 Issue: ArGoSoft FTP Server reveals valid usernames and allows for brute force attacks URL: http://www.argosoft.com/ftpserver/ Advisory: http://www.lovebug.org/argosoftadvisory.txt Program Overview: ArGoSoft FTP Server is a lightweight FTP Server for...

CVE-2004-2313

Inter7 SqWebMail 3.4.1 through 3.6.1 generates different error messages for incorrect passwords versus correct passwords on non-mail-enabled accounts such as root, which allows remote attackers to guess the root password via brute force attacks...

CVE-2004-1143

The password generation in mailman before 2.1.5 generates only 5 million unique passwords, which makes it easier for remote attackers to guess passwords via a brute force attack...

CVE-2004-2313

Inter7 SqWebMail 3.4.1 through 3.6.1 generates different error messages for incorrect passwords versus correct passwords on non-mail-enabled accounts such as root, which allows remote attackers to guess the root password via brute force attacks...

CVE-2004-1219

paFileDB 3.1, when using sessions authentication and while the administrator logs on, allows remote attackers to read the administrator's password hash and conduct brute force password guessing attacks by listing the contents of the sessions directory and reading the associated file for the...