Cisco LEAP - Password Disclosure

Cisco LEAP - Password Disclosure source: https://www.securityfocus.com/bid/8755/info It has been reported that Cisco LEAP Lightweight Extensible Authentication Protocol is prone to a password disclosure weakness that may allow a remote user to steal user passwords. The issue may be exploited out ...

CVE-2003-0402

The default login template /vgn/login in Vignette StoryServer 5 and Vignette V/5 generates different responses whether a user exists or not, which allows remote attackers to identify valid usernames via brute force attacks...

CVE-2003-0402

CVE-2003-0402 affects Vignette StoryServer 5 and Vignette V/5, where the default login template (/vgn/login) returns different responses depending on whether a user exists. This behavior allows remote attackers to identify valid usernames via brute force, enabling username enumeration. The NVD en...

S21SEC-020 - Vignette user enumeration

ID: S21SEC-020-en Title: Vignette user enumeration Date: 15/03/2003 Status: Vendor contacted and solution available Scope: Enumeration of user status Platforms: All Author: rpinuaga Location: http://www.s21sec.com/es/avisos/s21sec-020-en.txt Release: External S 2 1 S E C http://www.s21sec.com...

CVE-2003-0343

BlackMoon FTP Server 2.6 Free Edition (and possibly other versions) returns an "Account does not exist" message when an invalid username is provided, enabling an attacker to enumerate valid accounts and, as a consequence, facilitate brute‑force login attempts. The Nessus plugin confirms the enume...

CVE-2003-0343

BlackMoon FTP Server 2.6 Free Edition, and possibly other distributions and versions, generates an "Account does not exist" error message when an invalid username is entered, which makes it easier for remote attackers to conduct brute force attacks...

CVE-2003-0343

BlackMoon FTP Server 2.6 Free Edition, and possibly other distributions and versions, generates an "Account does not exist" error message when an invalid username is entered, which makes it easier for remote attackers to conduct brute force attacks...

MySQL 3.x/4.0.x - Weak Password Encryption

// source: https://www.securityfocus.com/bid/7500/info MySQL has been reported to implement a weak password encryption algorithm. It has been reported that the MySQL function used to encrypt MySQL passwords makes just one pass over the password and employs a weak left shift based cipher. The hash...

CVE-2001-0978

login in HP-UX 10.26 does not record failed login attempts in /var/adm/btmp, which could allow attackers to conduct brute force password guessing attacks without being detected or observed using the lastb program...

Microsoft Windows SMB Registry : Winlogon Cached Password Weakness

The registry key 'HKLM\Software\Microsoft\WindowsNT\CurrentVersion\ Winlogon\CachedLogonsCount' is not 0. Using a value greater than 0 for the CachedLogonsCount key indicates that the remote Windows host locally caches the passwords of the users when they login, in order to continue to allow the...

CVE-2002-2410

openwebmail.pl in Open WebMail 1.7 and 1.71 reveals sensitive information in error messages and generates different responses whether a user exists or not, which allows remote attackers to identify valid usernames via brute force attacks and obtain certain configuration and version information...

CVE-2002-2119

Novell eDirectory 8.6.2 and 8.7 use case insensitive passwords, which makes it easier for remote attackers to conduct brute force password guessing...

CVE-2002-1065

Thomas Hauck Jana Server 2.x through 2.2.1, and 1.4.6 and earlier, does not restrict the number of unsuccessful login attempts, which makes it easier for remote attackers to gain privileges via brute force username and password guessing...

CVE-2002-1065

Thomas Hauck Jana Server 2.x through 2.2.1, and 1.4.6 and earlier, does not restrict the number of unsuccessful login attempts, which makes it easier for remote attackers to gain privileges via brute force username and password guessing...

Advisory: DoS in WebEasyMail +more possible?

Author: Stan Bubrouski Date: August 19, 2002 Product: WebEasyMail Versions Affected: 3.4.2.2 Latest + previous Severity: Denial of Service on SMTP and POP3 portions of the software. It has not been investigated but there might be a possibility of exploitation to execute code remotely. Problem 1:...

CVE-2002-0580

WorkforceROI Xpede 4.1 allows remote attackers to obtain the database username via a request to datasource.asp, which leaks the username in a form and allows the attacker to more easily conduct brute force password guessing attacks...

CVE-2001-1356

Affected software: NetWin SurgeFTP 2.0f and earlier. Vulnerability: passwords are encrypted with weak hashing, a fixed salt, and modulo 40 arithmetic, enabling remote attackers to perform brute‑force password guessing against the administrator account on port 7021. Impact: attacker could compromi...

CVE-2001-1339

Beck IPC GmbH IPC@CHIP telnet service does not delay or disconnect users from the service when bad passwords are entered, which makes it easier for remote attackers to conduct brute force password guessing attacks...

Microsoft Windows - Local Users Information : Automatically Disabled Accounts

Using the supplied credentials, Nessus was able to list local user accounts that have been automatically disabled. These accounts may have been disabled for security reasons or due to brute-force attack attempts. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid10911;...

Microsoft Windows - Users Information : Automatically Disabled Accounts

Using the supplied credentials, Nessus was able to list user accounts that have been automatically disabled. These accounts may have been disabled for security reasons or due to brute-force attack attempts. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid10895;...