PT-2012-3989

Name of the Vulnerable Software and Affected Versions Bytemark Symbiosis versions prior to Revision 1322 Description The issue allows remote attackers to gain access to email accounts using an arbitrary password due to improper password validation. Recommendations For versions prior to Revision...

WinRadius Server 2009 - Denial of Service

WinRadius Server 2009 - Denial of Service Title: WinRadius Server Denial Of Service Vulnerability Software : WinRadius Software Version : v2009 Vendor: http://www.elite-school.com/saas/WinRadius/ Vulnerability Published : 2012-05-27 Vulnerability Update Time : Status : Impact : MediumCVSS2 Base :...

WinRadius Server 2009 - Denial of Service

Title: WinRadius Server Denial Of Service Vulnerability Software : WinRadius Software Version : v2009 Vendor: http://www.elite-school.com/saas/WinRadius/ Vulnerability Published : 2012-05-27 Vulnerability Update Time : Status : Impact : MediumCVSS2 Base : 5.0, AV:N/AC:L/Au:N/C:N/I:N/A:P Bug...

正方教务管理系统web端补考成绩录入漏洞

简要描述： web端成绩录入可绕过密码验证录入补考成绩。 详细说明： 此漏洞与 WooYun: 正方教务管理系统web端成绩录入漏洞 类似。 web端在进行成绩录入时可以通过直接将动态页面从jscjmm.aspx修改为xfjsbkcjlr.aspx进行绕过，只要具有教师的登录权限，不需要验证成绩录入密码即可直接进入成绩的录入和提交页面。 我写了一个脚本用于测试我所在学校的教师账户，发现有几百个教师账户仍旧使用默认账户密码，如果通过此漏洞将造成巨大影响，我也准备将所收集的资料上报校方处理。 漏洞证明： 此漏洞与 WooYun: 正方教务管理系统web端成绩录入漏洞 类似，就不再截图证明了。...

Stack overflow

Stack-based buffer overflow in the password-validation functionality in Directory Services in Apple Mac OS X 10.5.8 and 10.6.x before 10.6.5 allows remote attackers to execute arbitrary code or cause a denial of service application crash via unspecified vectors...

CVE-2010-1840

Stack-based buffer overflow in the password-validation functionality in Directory Services in Apple Mac OS X 10.5.8 and 10.6.x before 10.6.5 allows remote attackers to execute arbitrary code or cause a denial of service application crash via unspecified vectors...

PT-2010-3466

Name of the Vulnerable Software and Affected Versions Mac OS X versions 10.5.8 through 10.6.4 Description A stack-based buffer overflow issue exists in the password-validation functionality in Directory Services, allowing remote attackers to execute arbitrary code or cause a denial of service via...

Confluence features that require password confirmation (websudo, captcha) do not work with custom authentication

When user is required to confirm the password, Confluence always checks the entered password against the internally stored user/password. If an instance is configured to use custom authentication which is different from atlassian-user, the password validation will fail. h3. Resolution This is fix...

Apple Releases Security Update 2010-006

Apple has released security update 2010-006 for Mac OS X and Mac OS X Server to address a vulnerability in the AFP package. This vulnerability may allow an attacker to bypass password validation and obtain sensitive information. The article indicates that this vulnerability does not affect system...

Nokia E72 smartphone protection bypass

Keyboard is not locked during password validation...

Apache CouchDB timing attack

Password validation algorythm allows to guess matching part...

Design/Logic Flaw

Kingston DataTraveler BlackBox DTBB, DataTraveler Secure Privacy Edition DTSP, and DataTraveler Elite Privacy Edition DTEP USB flash drives validate passwords with a program running on the host computer rather than the device hardware, which allows physically proximate attackers to access the...

CVE-2010-0221

Kingston DataTraveler BlackBox DTBB, DataTraveler Secure Privacy Edition DTSP, and DataTraveler Elite Privacy Edition DTEP USB flash drives validate passwords with a program running on the host computer rather than the device hardware, which allows physically proximate attackers to access the...

Design/Logic Flaw

SanDisk Cruzer Enterprise USB flash drives validate passwords with a program running on the host computer rather than the device hardware, which allows physically proximate attackers to access the cleartext drive contents via a modified program...

Design/Logic Flaw

Verbatim Corporate Secure and Corporate Secure FIPS Edition USB flash drives validate passwords with a program running on the host computer rather than the device hardware, which allows physically proximate attackers to access the cleartext drive contents via a modified program...

CVE-2010-0227

Verbatim Corporate Secure and Corporate Secure FIPS Edition USB flash drives validate passwords with a program running on the host computer rather than the device hardware, which allows physically proximate attackers to access the cleartext drive contents via a modified program...

CVE-2010-0224

The CVE-2010-0224 entry concerns SanDisk Cruzer Enterprise USB flash drives. Affected component: the authentication/password validation conducted by a program running on the host computer instead of the drive’s hardware. Root cause: password verification occurs outside the device hardware, enabli...

CVE-2010-0221

Kingston DataTraveler BlackBox DTBB, DataTraveler Secure Privacy Edition DTSP, and DataTraveler Elite Privacy Edition DTEP USB flash drives validate passwords with a program running on the host computer rather than the device hardware, which allows physically proximate attackers to access the...

CVE-2010-0227: Undefined Security Weakness

Verbatim Corporate Secure and Corporate Secure FIPS Edition USB flash drives validate passwords with a program running on the host computer rather than the device hardware, which allows physically proximate attackers to access the cleartext drive contents via a modified program...

CVE-2010-0224: Undefined Security Weakness

SanDisk Cruzer Enterprise USB flash drives validate passwords with a program running on the host computer rather than the device hardware, which allows physically proximate attackers to access the cleartext drive contents via a modified program...