CVE-2006-4080: Undefined Security Weakness

DeluxeBB 1.08, and possibly earlier, uses cookies that include the MD5 hash of a password, which allows remote attackers to gain privileges by sniffing or cross-site scripting XSS and conduct password guessing attacks...

CVE-2006-3753

setcookie.php for the administration login in Professional Home Page Tools Guestbook records the hash of the administrator password in a cookie, which allows attackers to conduct brute force password guessing attacks after obtaining the hash...

CVE-2006-3753

setcookie.php for the administration login in Professional Home Page Tools Guestbook records the hash of the administrator password in a cookie, which allows attackers to conduct brute force password guessing attacks after obtaining the hash...

CVE-2006-3753

The CVE-2006-3753 entry describes a vulnerability in setcookie.php used for the administration login in Professional Home Page Tools Guestbook. The implementation stores the hash of the administrator password in a cookie, which could enable an attacker to perform brute-force password guessing aft...

CVE-2006-3419: Undefined Security Weakness

Tor before 0.1.1.20 uses OpenSSL pseudo-random bytes RANDpseudobytes instead of cryptographically strong RANDbytes, and seeds the entropy value at start-up with 160-bit chunks without reseeding, which makes it easier for attackers to conduct brute force guessing attacks...

Design/Logic Flaw

enter.asp in Mini-Nuke 2.3 and earlier makes it easier for remote attackers to conduct password guessing attacks by setting the guvenlik parameter to the same value as the hidden gguvenlik parameter, which bypasses a verification step because the gguvenlik parameter is assumed to be immutable by...

CVE-2006-2734

enter.asp in Mini-Nuke 2.3 and earlier makes it easier for remote attackers to conduct password guessing attacks by setting the guvenlik parameter to the same value as the hidden gguvenlik parameter, which bypasses a verification step because the gguvenlik parameter is assumed to be immutable by...

CVE-2006-2734

enter.asp in Mini-Nuke 2.3 and earlier makes it easier for remote attackers to conduct password guessing attacks by setting the guvenlik parameter to the same value as the hidden gguvenlik parameter, which bypasses a verification step because the gguvenlik parameter is assumed to be immutable by...

CVE-2006-2734

CVE-2006-2734 concerns enter.asp in Mini-Nuke 2.3 and earlier. The vulnerability stems from the gguvenlik/guvenlik parameter handling: an attacker can set guvenlik to the same value as the hidden gguvenlik parameter, bypassing a verification step that relies on gguvenlik being immutable. This ena...

CVE-2006-2734: Undefined Security Weakness

enter.asp in Mini-Nuke 2.3 and earlier makes it easier for remote attackers to conduct password guessing attacks by setting the guvenlik parameter to the same value as the hidden gguvenlik parameter, which bypasses a verification step because the gguvenlik parameter is assumed to be immutable by...

PT-2006-2092 · Busybox +1 · Busybox +1

Name of the Vulnerable Software and Affected Versions: BusyBox version 1.1.1 Description: The issue is related to password generation, where a salt is not used, making it easier for local users to guess passwords from a stolen password file using techniques such as rainbow tables. Recommendations...

CVE-2005-4767

CVE-2005-4767 affects BEA WebLogic Server and WebLogic Express 8.1 SP5 and earlier, and 7.0 SP6 and earlier. The issue is that, when using username/password authentication, the server does not lock out a username after the maximum number of invalid login attempts, enabling easier guessing of pass...

CVE-2005-4767

BEA WebLogic Server and WebLogic Express 8.1 SP5 and earlier, and 7.0 SP6 and earlier, when using username/password authentication, does not lock out a username after the maximum number of invalid login attempts, which makes it easier for remote attackers to guess the password...

CVE-2005-4767: Undefined Security Weakness

BEA WebLogic Server and WebLogic Express 8.1 SP5 and earlier, and 7.0 SP6 and earlier, when using username/password authentication, does not lock out a username after the maximum number of invalid login attempts, which makes it easier for remote attackers to guess the password...

Design/Logic Flaw

PunBB 1.2.10 and earlier allows remote attackers to conduct brute force guessing attacks for an account's password, which may be as short as 4 characters...

CVE-2006-0866

PunBB 1.2.10 and earlier allows remote attackers to conduct brute force guessing attacks for an account's password, which may be as short as 4 characters...

CVE-2006-0866

PunBB 1.2.10 and earlier is affected by CVE-2006-0866: remote attackers can perform brute-force password guessing on accounts with passwords as short as 4 characters. The NVD entry assigns a CVSSv2 base score of 5.0 (Medium) with network attack vector, low attack complexity, no authentication req...

CVE-2006-0866

PunBB 1.2.10 and earlier allows remote attackers to conduct brute force guessing attacks for an account's password, which may be as short as 4 characters...

CVE-2006-0866: Undefined Security Weakness

PunBB 1.2.10 and earlier allows remote attackers to conduct brute force guessing attacks for an account's password, which may be as short as 4 characters...

CVE-2005-4767

BEA WebLogic Server and WebLogic Express 8.1 SP5 and earlier, and 7.0 SP6 and earlier, when using username/password authentication, does not lock out a username after the maximum number of invalid login attempts, which makes it easier for remote attackers to guess the password...