PT-2004-1397 · Ibm · Aix

Name of the Vulnerable Software and Affected Versions: AIX versions 4.3.3 through 5.1 Description: The issue allows remote attackers to guess the password via brute force methods when direct remote login is disabled. This occurs because AIX displays a different message if the password is correct...

PT-2004-1448 · Yabb · Yabb

Name of the Vulnerable Software and Affected Versions: YaBB version 1 SP 1.3.1 Description: The issue allows remote attackers to identify valid users due to different error messages being displayed when a user exists or not. This makes it easier to conduct a brute force password guessing attack...

CVE-2003-1035

CVE-2003-1035 describes a vulnerability in the default installation of SAP R/3 46C/D where remote attackers can bypass account lockout by using the RFC API instead of the SAPGUI to perform brute-force password guessing, since the SAPGUI lockout does not occur. The description notes that the RFC-b...

CVE-2003-1035

The default installation of SAP R/3 46C/D allows remote attackers to bypass account locking by using the RFC API instead of the SAPGUI to conduct a brute force password guessing attack, which does not lock out the account like the SAPGUI does...

CVE-2003-1230

The implementation of SYN cookies syncookies in FreeBSD 4.5 through 5.0-RELEASE-p3 uses only 32-bit internal keys when generating syncookies, which makes it easier for remote attackers to conduct brute force ISN guessing attacks and spoof legitimate traffic...

CVE-2003-0950

PeopleSoft PeopleTools 8.1x, 8.2x, and 8.4x allows remote attackers to execute arbitrary commands by uploading a file to the IClient Servlet, guessing the insufficiently random system time name of the directory used to store the file, and directly requesting that file...

CVE-2003-0637

Novell iChain 2.2 before Support Pack 1 uses a shorter timeout for a non-existent user than a valid user, which makes it easier for remote attackers to guess usernames and conduct brute force password guessing...

CVE-2003-0637

Novell iChain 2.2 before Support Pack 1 uses a shorter timeout for a non-existent user than a valid user, which makes it easier for remote attackers to guess usernames and conduct brute force password guessing...

CVE-2003-0637

Novell iChain 2.2 before Support Pack 1 is affected. The issue arises because the authentication timeout for non-existent users is shorter than for valid users, enabling remote attackers to enumerate usernames and perform brute-force password guessing. The root cause is the uneven timeout handlin...

PT-2003-1766 · Novell · Novell Ichain

Name of the Vulnerable Software and Affected Versions: Novell iChain version 2.2 before Support Pack 1 Description: The issue allows remote attackers to guess usernames and conduct brute force password guessing more easily due to a shorter timeout for non-existent users compared to valid users...

CVE-2003-0512

Cisco IOS 12.2 and earlier generates a "% Login invalid" message instead of prompting for a password when an invalid username is provided, which allows remote attackers to identify valid usernames on the system and conduct brute force password guessing, as reported for the Aironet Bridge...

CVE-2001-1291

The CVE-2001-1291 entry concerns the telnet server on 3Com PS40 SuperStack II hardware that does not delay or disconnect after incorrect username/password attempts, enabling easier brute‑force access. Connected PT-2001-2418 notes affected versions are not specified, and there is no documented fix...

CVE-2001-0978

CVE-2001-0978 affects HP-UX 10.26 where failed login attempts are not recorded in /var/adm/btmp, enabling brute‑force password guessing without detection via lastb. Severity in NVD shows High (CVSSv2 base 7.5, network access, no authentication). The entry notes the absence of observation of faile...

CVE-2002-1647

The quick login feature in Slash Slashcode does not redirect the user to an alternate URL when the wrong password is provided, which makes it easier for remote web sites to guess the proper passwords by reading the username and password from the Referrer URL...

CVE-2002-2028

The screensaver on Windows NT 4.0, 2000, XP, and 2002 does not verify if a domain account has already been locked when a valid password is provided, which makes it easier for users with physical access to conduct brute force password guessing...

CVE-2002-1654

iPlanet Web Server Enterprise Edition and Netscape Enterprise Server 4.0 and 4.1 allows remote attackers to conduct HTTP Basic Authentication via the wp-force-auth Web Publisher command, which provides a distinct attack vector and may make it easier to conduct brute force password guessing withou...

PT-2002-2839 · Novell · Novell Edirectory

Name of the Vulnerable Software and Affected Versions: Novell eDirectory versions 8.6.2 through 8.7 Description: The issue allows remote attackers to conduct brute force password guessing more easily due to the use of case insensitive passwords. Recommendations: For Novell eDirectory versions 8.6...

MySQL 3.23.x4.0.x - COM_CHANGE_USER Password Length Account

MySQL 3.23.x4.0.x - COMCHANGEUSER Password Length Account / source: https://www.securityfocus.com/bid/6373/info A flaw in the password authentication mechanism for MySQL may make it possible for an authenticated database user to compromise the accounts of other database users. The flaw lies in th...

MySQL 3.23.x/4.0.x - 'COM_CHANGE_USER' Password Length Account

/ source: https://www.securityfocus.com/bid/6373/info A flaw in the password authentication mechanism for MySQL may make it possible for an authenticated database user to compromise the accounts of other database users. The flaw lies in the fact that the server uses a string returned by the clien...

SecuRemote usernames can be guessed or sniffed using IKE exchange

SecuRemote usernames can be guessed or sniffed using IKE exchange Introduction: ------------- While performing a VPN security analysis for one of our customers, I discovered a potential issue with Firewall-1 SecuRemote IKE which can allow usernames to be guessed. I also observed the related issue...