Information disclosure

EMC Cloud Tiering Appliance CTA 9.x through 10 SP1 and File Management Appliance FMA 7.x store DES password hashes for the root, super, and admin accounts, which makes it easier for context-dependent attackers to obtain sensitive information via a brute-force attack...

samba: Password lockout not enforced for SAMR password changes

Samba 3.x before 3.6.23, 4.0.x before 4.0.16, and 4.1.x before 4.1.6 does not enforce the password-guessing protection mechanism for all interfaces, which makes it easier for remote attackers to obtain access via brute-force ChangePasswordUser2 1 SAMR or 2 RAP attempts...

Kemana Directory 1.5.6 - 'qvc_init()' Cookie Poisoning CAPTCHA Bypass

!C:\Perl64\bin\perl.exe Kemana Directory 1.5.6 qvcinit Cookie Poisoning CAPTCHA Bypass Exploit Vendor: C97net Product web page: http://www.c97.net Affected version: 1.5.6 Summary: Experience the ultimate directory script solution with Kemana. Create your own Yahoo or Dmoz easily with Kemana...

Microsoft Windows Security Account Manager Remote protocol Security Bypass Vulnerability

Description Microsoft Windows is prone to a security-bypass vulnerability. An attacker can exploit this issue to bypass certain security restrictions and aid in brute-force attacks; other attacks may also be possible. Technologies Affected Avaya Aura Conferencing 6.0 SP1 Standard Avaya Aura...

MGASA-2014-0080 Updated denyhosts package fixes security vulnerability

Helmut Grohne discovered that denyhosts, a tool preventing SSH brute-force attacks, could be used to perform remote denial of service against the SSH daemon. Incorrectly specified regular expressions used to detect brute force attacks in authentication logs could be exploited by a malicious user ...

BlackPOS Malware used in TARGET Data Breach developed by 17-Year Old Russian Hacker

The Holiday data breach at TARGET appeared to be part of a broad and highly sophisticated international hacking campaign against multiple retailers, involving the heist of possibly 110 million Credit-Debit cards, and personal information. Target confirmed last weekend that a malicious software wa...

Debian DSA-2826-1 : denyhosts - remote denial of ssh service

Helmut Grohne discovered that denyhosts, a tool preventing SSH brute-force attacks, could be used to perform remote denial of service against the SSH daemon. Incorrectly specified regular expressions used to detect brute-force attacks in authentication logs could be exploited by a malicious user ...

Debian Security Advisory DSA 2826-1 (denyhosts - Remote denial of ssh service)

Helmut Grohne discovered that denyhosts, a tool preventing SSH brute-force attacks, could be used to perform remote denial of service against the SSH daemon. Incorrectly specified regular expressions used to detect brute force attacks in authentication logs could be exploited by a malicious user ...

DSA-2826-1 denyhosts - Remote denial of ssh service

Bulletin has no description...

ESA-2013-047: RSA® Authentication Agent for PAM Unlimited Login Attempts Vulnerability

ESA-2013-047.txt -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ESA-2013-047: RSA® Authentication Agent for PAM Unlimited Login Attempts Vulnerability EMC Identifier: ESA-2013-047 CVE Identifier: CVE-2013-3271 Severity Rating: CVSS v2 Base Score: 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P Affected Products: R...

Amazon Linux AMI : python-crypto (ALAS-2012-86)

PyCrypto before 2.6 does not produce appropriate prime numbers when using an ElGamal scheme to generate a key, which reduces the signature space or public key space and makes it easier for attackers to conduct brute-force attacks to obtain the private key. C Tenable Network Security, Inc. The...

New Botnet Campaign 'Fort Disco' Brute-Forcing Thousands of WordPress, Joomla Websites

Password theft has been a growing problem within the security community. Researchers at Arbor Networks have uncovered a botnet called Fort Disco that was used to compromise more than 6000 websites based on popular CMSs such as WordPress, Joomla and Datalife Engine. The Fort Disco botnet is...

Fort Disco Botnet Uses Brute-Force Attacks Against CMS Sites

More than 6,000 websites built on content management systems such as WordPress, Joomla and Datalife Engine were compromised in a new brute-force attack campaign, according to a researcher at Arbor Networks. A botnet called Fort Disco, currently made up of 25,000 Windows machines, is responsible f...

WordPress Update 3.5.2 Patches Seven Vulnerabilities

WordPress, which has been a jumping off point for a number of targeted attacks and other high-profile hacks, has been updated and the latest version includes a number of security patches. Version 3.5.2, released late last week, includes seven security fixes and some additional hardening, accordin...

Popular WordPress Themes, Plug-Ins Vulnerable to Attack

Since late March, no fewer than a half-dozen high profile attacks have involved a compromised website built on the WordPress platform. Attackers abuse vulnerabilities in the content management system’s customizable plug-ins and themes to pull off anything from drive-by downloads to watering hole...

Cracking 16 Character Strong passwords in less than an hour

The Password serves to protect your financial transactions, your social networking sites, and a host of other nominally secure websites online. People often say, "don't use dictionary words as passwords. They are horribly unsecure", but what if hackers also managed to crack any 16 character...

Cracking 16 Character Strong passwords in less than an hour

The Password serves to protect your financial transactions, your social networking sites, and a host of other nominally secure websites online. People often say, "don't use dictionary words as passwords. They are horribly unsecure", but what if hackers also managed to crack any 16 character...

Hackers Using Brute-Force Attacks to Harvest WordPress Sites

Months of distributed denial of service attacks against major U.S. banks have evolved in magnitude and ferocity causing service disruptions for online banking customers. They’ve also shown the way for other attackers to adapt and evolve techniques used in those attacks. Apparently, someone is...

RC4 encryption protocol is vulnerable to certain brute force attacks – Opera Security Advisories

Weaknesses in the RC4 encryption protocol have been found, allowing an attacker to deduce the plaintext. If the same message is encrypted many millions of times, statistical methods can be used to extract valuable information, such as cookies. Due to the time this amount of requests takes, this i...

Alt-N MDaemon's WorldClient Username Enumeration Vulnerability

==================================================================== Alt-N MDaemon's WorldClient Username Enumeration Vulnerability ==================================================================== Software: Alt-N MDaemon v13.0.3 and prior versions Vendor: http://www.altn.com/ Vuln Type:...