CVE-2006-4068

The CVE concerns a client-side pswd.js script that relies on the user’s environment to verify a username/password against hard-coded hashed values on the server. The hashing scheme reportedly produces a large number of collisions, which can ease offline brute-force attempts by an attacker. The de...

CVE-2006-4068

The pswd.js script relies on the client to calculate whether a username and password match hard-coded hashed values for a server, and uses a hashing scheme that creates a large number of collisions, which makes it easier for remote attackers to conduct offline brute force attacks. NOTE: this scri...

DEBIAN-CVE-2006-1058

BusyBox 1.1.1 does not use a salt when generating passwords, which makes it easier for local users to guess passwords from a stolen password file using techniques such as rainbow tables...

crypt_blowfish 1.0

Hi, This is to announce the first mature version of cryptblowfish and the minor security fix that this version adds. cryptblowfish is a public domain implementation of a modern password hashing algorithm based on the Blowfish block cipher, provided via the crypt3 and a reentrant interface. It is...

MD5 - Message Digest Algorithm Hash Collision

MD5 - Message Digest Algorithm Hash Collision source: https://www.securityfocus.com/bid/11849/info The MD5 algorithm is reported prone to a hash collision weakness. This weakness reportedly allows attackers to create multiple, differing input sources that, when the MD5 algorithm is used, result i...

Hydra: VNC

This plugin runs Hydra to find VNC passwords by brute force. To use this plugin, enter the 'Logins file' and the 'Passwords file' under the 'Hydra NASL wrappers options' advanced settings block. TRUSTED...

Hydra: LDAP

This plugin runs Hydra to find LDAP accounts and passwords by brute force. To use this plugin, enter the 'Logins file' and the 'Passwords file' under the 'Hydra NASL wrappers options' advanced settings block. TRUSTED...

Pavuk Digest - Authentication Remote Buffer Overflow

/ exploit for pavuk web spider - infamous42md AT hotpop DOT com shouts to mitakeet, skullandcircle, and thanks to matt murphy for making me realize a n00bish mistake i made. this exploit probably deserves a bit of an explanation as it was not exactly straight forward. the vulnerable code looks li...

CVE-2004-0679

The IP cloaking feature cloak.c in UnrealIRCd 3.2, and possibly other versions, uses a weak hashing scheme to hide IP addresses, which could allow remote attackers to use brute force methods to gain other user's IP addresses...

CVE-2004-0679

CVE-2004-0679 concerns UnrealIRCd 3.2 (and possibly other versions) where the IP cloaking feature (cloak.c) uses a weak hashing scheme to hide IP addresses. This flaw could allow remote attackers to perform brute force attempts to reveal other users’ IP addresses. Multiple connected sources (NVD ...

CVE-2004-0679

The IP cloaking feature cloak.c in UnrealIRCd 3.2, and possibly other versions, uses a weak hashing scheme to hide IP addresses, which could allow remote attackers to use brute force methods to gain other user's IP addresses...

Unreal ircd ip cloacking protection bypass

To hide real IP hash of IP address with simple hashing algorithm is used...

[Full-Disclosure] Unreal ircd 3.2 clocking subsystem vulnerability

Software name: Unreal ircd Vulnerable versions: 3.2 and probably previous versions Problem nature: Information disclosure Summary: Unreal ircd is a popular irc server. One of the features it provides is called 'ip cloaking'. The purpose of this system is to prevent hostile irc users from getting...

jportal.txt

Jportal is a portal system, quite commonly used: Google Results 1 - 10 of about 56,100 for "powered by jportal". 0.22 seconds Homepage: http://jportal2.com/ I've read its code and found: in module/print.inc.php: function artprint .... $query = "SELECT FROM $arttbl WHERE id=$id"; ... What to say? ...

CVE-2003-1480

MySQL 3.20 through 4.1.0 uses a weak algorithm for hashed passwords, which makes it easier for attackers to decrypt the password via brute force methods...

[Full-Disclosure] PrimeBase SQL Database server cleartext password storage.

PrimeBase SQL Database server cleartext password storage. Vapid Labs Security Note 10/20/03 The PrimeBase SQL Database Server 4.2 stores passwords in clear text, and based on the installation users umask settings maybe readable by all local users. From the readme.txt file: "The Admin server will...

CVE-2001-1354

The CVE-2001-1354 entry concerns the NetWin Authentication module (NWAuth) versions 2.0 and 3.0b, as implemented in SurgeFTP and DMail (and possibly other packages). The root cause is weak password hashing used by NWAuth, which could enable local users to decrypt stored passwords or to log in wit...

CVE-2001-1356

Affected software: NetWin SurgeFTP 2.0f and earlier. Vulnerability: passwords are encrypted with weak hashing, a fixed salt, and modulo 40 arithmetic, enabling remote attackers to perform brute‑force password guessing against the administrator account on port 7021. Impact: attacker could compromi...

CVE-2001-1354

NetWin Authentication module NWAuth 2.0 and 3.0b, as implemented in SurgeFTP, DMail, and possibly other packages, uses weak password hashing, which could allow local users to decrypt passwords or use a different password that has the same hash value as the correct password...

SurgeFTP admin account bruteforcable

SurgeFTP admin account bruteforcable AFFECTED SYSTEMS SurgeFTP = 2.0f on a win32 platform, should give the same results on nix DESCRIPTION SurgeFTP uses the same extremely weak hashing algorithm as the NWauth module to store the admin password, but adding a fixed 'salting' value which is "qr"...