Sonatype Nexus Repository Manager Weak Password Vulnerability

Sonatype Nexus Repository Manager is a maven repository manager. A security vulnerability exists in the LDAP integration feature in Sonatype Nexus Repository Manager 2.14.5 and earlier versions, which stems from the program's use of hard-coded CMMDwoV values to encrypt passwords. An attacker coul...

Sonatype Nexus Repository Manager 2.x Weak Password Encryption Vulnerability (Dec 2017)

Sonatype Nexus Repository Manager has a weak password encryption with a hardcoded CMMDwoV value in the LDAP integration feature. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

Hardcoded credentials

Sonatype Nexus Repository Manager through 2.14.5 has weak password encryption with a hardcoded CMMDwoV value in the LDAP integration feature...

CVE-2017-17717

Sonatype Nexus Repository Manager through 2.14.5 has weak password encryption with a hardcoded CMMDwoV value in the LDAP integration feature...

CVE-2017-17717

CVE-2017-17717 affects Sonatype Nexus Repository Manager up to version 2.14.5. The vulnerability lies in the LDAP integration feature, which uses hard-coded CMMDwoV values to encrypt passwords, resulting in weak password encryption. Documents consistently describe the issue as a weakness in passw...

CVE-2017-17717

Sonatype Nexus Repository Manager through 2.14.5 has weak password encryption with a hardcoded CMMDwoV value in the LDAP integration feature...

Scientific Linux Security Update : java-1.7.0-openjdk on SL6.x, SL7.x i386/x86_64 (20171206)

Security Fixes : - Multiple flaws were discovered in the RMI and Hotspot components in OpenJDK. An untrusted Java application or applet could use these flaws to completely bypass Java sandbox restrictions. CVE-2017-10285, CVE-2017-10346 - It was discovered that the Kerberos client implementation ...

RedHat Update for java-1.7.0-openjdk RHSA-2017:3392-01

The remote host is missing an update for the SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

MOXA EDS-G512E Password Encryption Method Vulnerability

The MOXA EDS-G512E is a Gigabit Ethernet managed switch. A password encryption method vulnerability exists in the MOXA EDS-G512E 5.1 build 16072215. An attacker can reverse the password encryption algorithm to retrieve the value...

CVE-2017-13699

An issue was discovered on MOXA EDS-G512E 5.1 build 16072215 devices. The password encryption method can be retrieved from the firmware. This encryption method is based on a chall value that is sent in cleartext as a POST parameter. An attacker could reverse the password encryption algorithm to...

CVE-2017-13699

An issue was discovered on MOXA EDS-G512E 5.1 build 16072215 devices. The password encryption method can be retrieved from the firmware. This encryption method is based on a chall value that is sent in cleartext as a POST parameter. An attacker could reverse the password encryption algorithm to...

CVE-2017-13699

CVE-2017-13699 affects MOXA EDS-G512E (5.1 build 16072215). The password encryption is retrievable from the firmware; the encryption is based on a cleartext chall value sent via POST. An attacker could reverse the password encryption algorithm to obtain it, exposing credentials. No exploitation d...

CVE-2017-13699

An issue was discovered on MOXA EDS-G512E 5.1 build 16072215 devices. The password encryption method can be retrieved from the firmware. This encryption method is based on a chall value that is sent in cleartext as a POST parameter. An attacker could reverse the password encryption algorithm to...

CVE-2017-1339

IBM Spectrum Protect 7.1 and 8.1 formerly Tivoli Storage Manager Server uses weak encryption for the password. A database administrator may be able to decrypt the IBM Spectrum protect client or administrator password which can result in information disclosure or a denial of service. IBM X-Force I...

CVE-2017-9859

An issue was discovered in SMA Solar Technology products. The inverters make use of a weak hashing algorithm to encrypt the password for REGISTER requests. This hashing algorithm can be cracked relatively easily. An attacker will likely be able to crack the password using offline crackers. This...

CVE-2017-9859

An issue was discovered in SMA Solar Technology products. The inverters make use of a weak hashing algorithm to encrypt the password for REGISTER requests. This hashing algorithm can be cracked relatively easily. An attacker will likely be able to crack the password using offline crackers. This...

CVE-2017-9859

CVE-2017-9859 concerns SMA Solar Technology inverters (Sunny Boy TLST-21/TL-21 and Sunny Tripower TL-10/TL-30). The issue is use of a weak hashing algorithm to encrypt passwords for REGISTER requests, which can be cracked offline, enabling an attacker to recover the password and register at SMA s...

VICIdial user_authorization command execution vulnerability

ICIdial is based on the Asterisk open source PBX system is a more complete handling of a large number of inbound and outbound call center software package, initially funded by Digium for research and development, to the open source community to maintain in order to extend the Asterisk application...

VICIdial 2.9 RC 1 < 2.13 RC1 - 'user_authorization' Command Execution (Metasploit)

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'VICIdial userauthorization Unauthenticated Command Execution', 'Description' = %q This module exploits a vulnerability in VICIdial versions 2.9 R...

VICIdial user_authorization Unauthenticated Command Execution

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'VICIdial userauthorization Unauthenticated Command Execution', 'Description' = %q This module exploits a vulnerability in VICIdial versions 2.9 RC...