CVE-2012-5552

Summary: The Password policy module for Drupal 6.x and 7.x contains a vulnerability where, when the module’s “previous passwords” feature is enabled, an attacker who can view HTTP traffic can obtain a user’s hashed password due to lack of encrypted transport. This affects: Drupal 6.x-1.x prior to...

SA-CONTRIB-2012-159 - Password policy - Information leakage of hashed passwords

This module provides a way to specify a certain level of password complexity aka. "password hardening" for user passwords on a system by defining a password policy. The Password policy module allows administrators to request users to enter a new password that does not match any of the previous X...