tog-pegasus: failed authentication attempts not logged via PAM

tog-pegasus in OpenGroup Pegasus 2.7.0 on Red Hat Enterprise Linux RHEL 5, Fedora 9, and Fedora 10 does not log failed authentication attempts to the OpenPegasus CIM server, which makes it easier for remote attackers to avoid detection of password guessing attacks...

Important: Red Hat Security Advisory: tog-pegasus security update

Updated tog-pegasus packages that fix security issues are now available for Red Hat Enterprise Linux 5. This update has been rated as having important security impact by the Red Hat Security Response Team. The tog-pegasus packages provide OpenPegasus Web-Based Enterprise Management WBEM services...

pop3-brute NSE Script

Tries to log into a POP3 account by guessing usernames and passwords. Script Arguments pop3loginmethod The login method to use: "USER" default, "SASL-PLAIN", "SASL-LOGIN", "SASL-CRAM-MD5", or "APOP". Defaults to "USER", passdb, unpwdb.passlimit, unpwdb.timelimit, unpwdb.userlimit, userdb See the...

CVE-2008-4929: Use of Insufficiently Random Values

MyBB aka MyBulletinBoard 1.4.2 uses insufficient randomness to compose filenames of uploaded files used as attachments, which makes it easier for remote attackers to read these files by guessing filenames...

CVE-2008-4000

Unspecified vulnerability in the PeopleTools component in Oracle PeopleSoft Enterprise and JD Edwards EnterpriseOne 8.48.18 and 8.49.14 allows remote attackers to affect confidentiality and integrity via unknown vectors. NOTE: the previous information was obtained from the Oracle October 2008 CPU...

Design/Logic Flaw

Unspecified vulnerability in the PeopleTools component in Oracle PeopleSoft Enterprise and JD Edwards EnterpriseOne 8.48.18 and 8.49.14 allows remote attackers to affect confidentiality and integrity via unknown vectors. NOTE: the previous information was obtained from the Oracle October 2008 CPU...

CVE-2008-4000

Unspecified vulnerability in the PeopleTools component in Oracle PeopleSoft Enterprise and JD Edwards EnterpriseOne 8.48.18 and 8.49.14 allows remote attackers to affect confidentiality and integrity via unknown vectors. NOTE: the previous information was obtained from the Oracle October 2008 CPU...

CVE-2008-4000

CVE-2008-4000 concerns an authentication weakness in Oracle PeopleTools used by PeopleSoft Enterprise and JD Edwards EnterpriseOne (notably PeopleTools 8.49.14 and 8.48.18). The Imperva advisory (SecurityVULNS:DOC:20750) details that the system’s authentication and account lockout can be bypassed...

Simple Machines Forum (SMF) < 1.1.6 Password Reset Vulnerability

Simple Machines Forum SMF is prone to a security bypass vulnerability. SPDX-FileCopyrightText: 2008 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

CVE-2008-3617: Undefined Security Weakness

Remote Management and Screen Sharing in Apple Mac OS X 10.5 through 10.5.4, when used to set a password for a VNC viewer, displays additional input characters beyond the maximum password length, which might make it easier for attackers to guess passwords that the user believed were longer...

McAfee Encrypted USB Manager Remote Security Bypass Vulnerability

The host is running McAfee Encrypted USB Manager, which is prone to sensitive information disclosure vulnerability. OpenVAS Vulnerability Test $Id: secpodmcafeeencryptusbmngrsecbypassvuln900026.nasl 5370 2017-02-20 15:24:26Z cfi $ Description: McAfee Encrypted USB Manager Remote Security Bypass...

McAfee加密USB管理器远程安全绕过漏洞

BUGTRAQ ID:30630 CNCAN ID：CNCAN-2008081202 McAfee Encrypted USB Manager是一款采用强大的加密技术，并结合强式存取控制方法来保护资料的解决方案。 McAfee Encrypted USB Manager存在安全绕过问题，远程攻击者可以利用漏洞执行离线攻击尝试猜测密码。 此漏洞只存在于当密码"Re-use Threshold"策略设置为非零值才有效，目前没有详细漏洞细节提供。 0 McAfee Encrypted USB Manager 3.1 0 升级到最新版本： McAfee Encrypted USB Manager...

CVE-2004-2760

sshd in OpenSSH 3.5p1, when PermitRootLogin is disabled, immediately closes the TCP connection after a root login attempt with the correct password, but leaves the connection open after an attempt with an incorrect password, which makes it easier for remote attackers to guess the password by...

CVE-2004-2760: Undefined Security Weakness

sshd in OpenSSH 3.5p1, when PermitRootLogin is disabled, immediately closes the TCP connection after a root login attempt with the correct password, but leaves the connection open after an attempt with an incorrect password, which makes it easier for remote attackers to guess the password by...

Authentication flaw

The ssh-vulnkey tool on Ubuntu Linux 7.04, 7.10, and 8.04 LTS does not recognize authorizedkeys lines that contain options, which makes it easier for remote attackers to exploit CVE-2008-0166 by guessing a key that was not identified by this tool...

CVE-2008-2291: Undefined Security Weakness

axengine.exe in Symantec Altiris Deployment Solution 6.8.x and 6.9.x before 6.9.176 generates credentials with a fixed salt or without any salt, which makes it easier for remote attackers to guess encrypted domain credentials...

CVE-2008-0166

OpenSSL 0.9.8c-1 up to versions before 0.9.8g-9 on Debian-based operating systems uses a random number generator that generates predictable numbers, which makes it easier for remote attackers to conduct brute force guessing attacks against cryptographic keys...

CVE-2008-0166

OpenSSL 0.9.8c-1 up to versions before 0.9.8g-9 on Debian-based operating systems uses a random number generator that generates predictable numbers, which makes it easier for remote attackers to conduct brute force guessing attacks against cryptographic keys...

CVE-2008-0166

CVE-2008-0166 describes a Debian/Ubuntu OpenSSL PRNG flaw caused by removing seeding steps in md_rand.c, which left the OpenSSL PRNG predictable. Consequently, OpenSSH/OpenSSL keys generated on affected Debian-based systems (2006–2008) could be brute-forced or reproduced. Connected docs indicate ...

CVE-2008-0166

OpenSSL 0.9.8c-1 up to versions before 0.9.8g-9 on Debian-based operating systems uses a random number generator that generates predictable numbers, which makes it easier for remote attackers to conduct brute force guessing attacks against cryptographic keys...