SecuRemote usernames can be guessed or sniffed using IKE exchange

SecuRemote usernames can be guessed or sniffed using IKE exchange Introduction: ------------- While performing a VPN security analysis for one of our customers, I discovered a potential issue with Firewall-1 SecuRemote IKE which can allow usernames to be guessed. I also observed the related issue...

CVE-2002-0453

The account lockout capability in Oblix NetPoint 5.2 and earlier only locks out users once for the specified lockout period, which makes it easier for remote attackers to conduct brute force password guessing by waiting until the lockout period ends, then guessing passwords without being locked o...

CVE-2001-1175

CVE-2001-1175 : In vipw from the util-linux package, before version 2.10, editing /etc/shadow could leave the file world-readable in some cases, enabling local users to more easily perform brute-force password guessing. Supported details in connected docs show Red Hat advisories (RHSA-2001:95, 13...

CVE-2001-0962

IBM WebSphere Application Server 3.02 through 3.53 uses predictable session IDs for cookies, which allows remote attackers to gain privileges of WebSphere users via brute force guessing...

CVE-2001-1175: Undefined Security Weakness

vipw in the util-linux package before 2.10 causes /etc/shadow to be world-readable in some cases, which would make it easier for local users to perform brute force password guessing...

CVE-2002-0453

The account lockout capability in Oblix NetPoint 5.2 and earlier only locks out users once for the specified lockout period, which makes it easier for remote attackers to conduct brute force password guessing by waiting until the lockout period ends, then guessing passwords without being locked o...

CVE-2001-1339

Beck IPC GmbH IPC@CHIP telnet service does not delay or disconnect users from the service when bad passwords are entered, which makes it easier for remote attackers to conduct brute force password guessing attacks...

CVE-2001-1175

vipw in the util-linux package before 2.10 causes /etc/shadow to be world-readable in some cases, which would make it easier for local users to perform brute force password guessing...

CVE-1999-1324

The issue affects OpenVMS running on VAXstations (OpenVMS 5.3–5.5-2) with VMS DECwindows or MOTIF, where access to accounts that exceeded the failed-login break-in limit is not properly disabled. This permits brute-force password guessing and is described in PT-1999-1646 as allowing attackers to ...

CVE-1999-1324

VAXstations running Open VMS 5.3 through 5.5-2 with VMS DECwindows or MOTIF do not properly disable access to user accounts that exceed the break-in limit threshold for failed login attempts, which makes it easier for attackers to conduct brute force password guessing...

CVE-2001-0950: Insufficient Entropy

ValiCert Enterprise Validation Authority EVA Administration Server 3.3 through 4.2.1 uses insufficiently random data to 1 generate session tokens for HSMs using the C rand function, or 2 generate certificates or keys using /dev/urandom instead of another source which blocks when the entropy pool ...

CVE-2001-0839

CVE-2001-0839 affects the iBill web app’s ibillpm.pl CGI password management. The vulnerability arises from a weak password generation mechanism that creates passwords based on a client’s MASTER_ACCOUNT, enabling brute-force guessing to modify entries in the .htpasswd file via remote access. The ...

CVE-1999-1524

FlowPoint DSL router firmware versions prior to 3.0.8 expose a network-accessible password recovery feature that is not confined to the serial console port, enabling a remote attacker to perform brute-force password guessing. The underlying issue is lack of access control on the password recovery...

CVE-1999-1029: Undefined Security Weakness

SSH server sshd2 before 2.0.12 does not properly record login attempts if the connection is closed before the maximum number of tries, allowing a remote attacker to guess the password without showing up in the audit logs...

CVE-1999-1152: Improper Restriction of Excessive Authentication Attempts

Compaq/Microcom 6000 Access Integrator does not disconnect a client after a certain number of failed login attempts, which allows remote attackers to guess usernames or passwords via a brute force attack...

PT-2001-2418 · 3Com · 3Com Ps40 Superstack Ii

Name of the Vulnerable Software and Affected Versions: 3Com PS40 SuperStack II affected versions not specified Description: The issue allows remote attackers to perform brute force password guessing without being delayed or disconnected after providing incorrect usernames or passwords, making it...

PT-2001-1613 · Lightwave · Lightwave Consoleserver 3200

Name of the Vulnerable Software and Affected Versions: Lightwave ConsoleServer 3200 Description: The issue allows remote attackers to conduct brute force password guessing because the system does not disconnect users after unsuccessful login attempts. Recommendations: For Lightwave ConsoleServer...

PT-2001-2463 · Beck Ipc Gmbh · Ipc@Chip

Name of the Vulnerable Software and Affected Versions: Beck IPC GmbH IPC@CHIP affected versions not specified Description: The issue allows remote attackers to conduct brute force password guessing attacks due to the lack of delay or disconnection when bad passwords are entered. This makes it...

CVE-2001-0056

The Cisco Web Management interface in routers running CBOS 2.4.1 and earlier does not log invalid logins, which allows remote attackers to guess passwords without detection...

CVE-2001-0056: Undefined Security Weakness

The Cisco Web Management interface in routers running CBOS 2.4.1 and earlier does not log invalid logins, which allows remote attackers to guess passwords without detection...