MGASA-2015-0295 Updated openssh package fixes security vulnerability

The OpenSSH server, when keyboard-interactive challenge response authentication is enabled and PAM is being used the default configuration in Mageia, can be tricked into allowing more password attempts than the MaxAuthTries setting would normally allow in one connection, which can aid an attacker...

Updated openssh package fixes security vulnerability

The OpenSSH server, when keyboard-interactive challenge response authentication is enabled and PAM is being used the default configuration in Mageia, can be tricked into allowing more password attempts than the MaxAuthTries setting would normally allow in one connection, which can aid an attacker...

John the Ripper GUI Frontend: Johnny

Johnny the open source cross-platform GUI frontend for John the Ripper, the popular password cracker, written in C++ using the Qt framework. Johnny’s aim is to automate and simplify the password cracking routine on the Desktop as well as add extra functionality like session management and easy...

Fedora 22 : openssh-6.9p1-1.fc22 (2015-11063)

This update brings security fix for two announced vulnerabilities. Namely XSECURITY restrictions bypass under certain conditions AND weakness of agent locking ssh-add -x to password guessing more info in related bugs. It also provides new version of openssh-6.9 which is bringing many bugfixes and...

Johnny - GUI for John the Ripper

Johnny is a cross-platform open-source GUI for the popular password cracker John the Ripper. Features 1. user could start, pause and resume attack though only one session is allowed globally, 2. all attack related options work, 3. all input file formats are supported pure hashes, pwdump, passwd,...

Nikto2 - Web Server Scanner

Nikto is an Open Source GPL web server scanner which performs comprehensive tests against web servers for multiple items, including over 6700 potentially dangerous files/programs, checks for outdated versions of over 1250 servers, and version specific problems on over 270 servers. It also checks...

IBM WebSphere MQIPT Information Disclosure Vulnerability

IBM WebSphere MQ is a solution for providing messaging services in the enterprise. IBM WebSphere MQIPT fails to properly handle HTTP session IDs, allowing remote attackers to exploit the vulnerability to guess the session ID to intercept MQ message data...

Lenovo System Update Security Token Predicts Arbitrary Code Execution Vulnerability

Lenovo System Update is a system upgrade tool for Lenovo. Lenovo System Update uses predictable security tokens to access the update mechanism, allowing local users to guess security tokens, provide tokens to the system upgrade service, and execute arbitrary commands...

Unspecified Vulnerability in Drupal Amazon AWS Module

Drupal is a free, open source content management system developed in the PHP language maintained by the Drupal community.Amazon AWS is one of the modules that integrates with Amazon Web Services AWS. A security vulnerability exists in the Drupal Amazon AWS module prior to version 7.x-1.3, which...

Apple iOS User Password Guessing Vulnerability

Apple iOS is the latest operating system that runs on Apple's iPhone and iPod touch devices. Apple iOS has a security vulnerability that allows attackers to exploit the vulnerability to maliciously guess user passwords...

CVE-2015-0997

Schneider Electric InduSoft Web Studio before 7.1.3.4 SP3 Patch 4 and InTouch Machine Edition 2014 before 7.1.3.4 SP3 Patch 4 provide an HMI user interface that lists all valid usernames, which makes it easier for remote attackers to obtain access via a brute-force password-guessing attack...

Default credentials

Schneider Electric InduSoft Web Studio before 7.1.3.4 SP3 Patch 4 and InTouch Machine Edition 2014 before 7.1.3.4 SP3 Patch 4 provide an HMI user interface that lists all valid usernames, which makes it easier for remote attackers to obtain access via a brute-force password-guessing attack...

CVE-2015-0997

Schneider Electric InduSoft Web Studio before 7.1.3.4 SP3 Patch 4 and InTouch Machine Edition 2014 before 7.1.3.4 SP3 Patch 4 provide an HMI user interface that lists all valid usernames, which makes it easier for remote attackers to obtain access via a brute-force password-guessing attack...

Multi Purpose Bruteforcer: Patator

Multi Purpose Bruteforcer Patator was written out of frustration from using Hydra, Medusa, Ncrack, Metasploit modules and Nmap NSE scripts for password guessing attacks. Patator is a multi-threaded tool written in Python, that strives to be more reliable and flexible than his fellow predecessors...

[SYSS-2014-013] FancyFon FAMOC - Use of a One-Way Hash without a Salt

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Advisory ID: SYSS-2014-013 Products: FAMOC Vendor: FancyFon Affected Versions: 3.16.5 Tested Versions: 3.16.5 Vulnerability Type: Use of a One-Way Hash without a Salt CWE-759 Risk Level: Low Solution Status: Fixed Vendor Notification: 2014-12-19...

Oracle Solaris Third-Party Patch Update : samba (cve_2013_4496_credentials_management)

The remote Solaris system is missing necessary patches to address security updates : - Samba 3.x before 3.6.23, 4.0.x before 4.0.16, and 4.1.x before 4.1.6 does not enforce the password-guessing protection mechanism for all interfaces, which makes it easier for remote attackers to obtain access v...

CVE-2014-8034

Cisco WebEx Meetings Server 1.5 presents the same CAPTCHA challenge for each login attempt, which makes it easier for remote attackers to obtain access via a brute-force approach of guessing usernames, aka Bug ID CSCuj40321...

CVE-2013-4442

Password Generator aka Pwgen before 2.07 uses weak pseudo generated numbers when /dev/urandom is unavailable, which makes it easier for context-dependent attackers to guess the numbers...

PYSEC-2014-76

Zope before 2.13.19, as used in Plone before 4.2.3 and 4.3 before beta 1, does not reseed the pseudo-random number generator PRNG, which makes it easier for remote attackers to guess the value via unspecified vectors. NOTE: this issue was SPLIT from CVE-2012-5508 due to different vulnerability...

Phabricator: Password Policy issue

Hello I hope you are doing fine. This is a very low severity issue that i just found out in your password policy. You have a good password policy implemented with the special characters and uppercase letters and stuff but the thing is that you do not check for passwords similar to the other field...