CVE-2009-4304

CVE-2009-4304 affects Moodle 1.8 before 1.8.11 and 1.9 before 1.9.7, where config.php does not use a random password salt, enabling easier brute‑force password guessing. Public documents indicate the fix is to upgrade to a newer Moodle version (e.g., 1.9.7), as referenced by Debian/OpenSUSE/OpenU...

CVE-2008-4315

tog-pegasus in OpenGroup Pegasus 2.7.0 on Red Hat Enterprise Linux RHEL 5, Fedora 9, and Fedora 10 does not log failed authentication attempts to the OpenPegasus CIM server, which makes it easier for remote attackers to avoid detection of password guessing attacks...

Design/Logic Flaw

tog-pegasus in OpenGroup Pegasus 2.7.0 on Red Hat Enterprise Linux RHEL 5, Fedora 9, and Fedora 10 does not log failed authentication attempts to the OpenPegasus CIM server, which makes it easier for remote attackers to avoid detection of password guessing attacks...

CVE-2008-4315

CVE-2008-4315 affects tog-pegasus (OpenPegasus WBEM) on RHEL 5, Fedora 9/10. The root cause is that failed authentication attempts to the OpenPegasus CIM server are not logged, which can enable password-guessing attacks to go undetected. Public references in connected documents show Red Hat/CentO...

tog security update

CentOS Errata and Security Advisory CESA-2008:1001 Updated tog-pegasus packages that fix security issues are now available for Red Hat Enterprise Linux 5. This update has been rated as having important security impact by the Red Hat Security Response Team. The tog-pegasus packages provide...

tog-pegasus: failed authentication attempts not logged via PAM

tog-pegasus in OpenGroup Pegasus 2.7.0 on Red Hat Enterprise Linux RHEL 5, Fedora 9, and Fedora 10 does not log failed authentication attempts to the OpenPegasus CIM server, which makes it easier for remote attackers to avoid detection of password guessing attacks...

Important: Red Hat Security Advisory: tog-pegasus security update

Updated tog-pegasus packages that fix security issues are now available for Red Hat Enterprise Linux 5. This update has been rated as having important security impact by the Red Hat Security Response Team. The tog-pegasus packages provide OpenPegasus Web-Based Enterprise Management WBEM services...

pop3-brute NSE Script

Tries to log into a POP3 account by guessing usernames and passwords. Script Arguments pop3loginmethod The login method to use: "USER" default, "SASL-PLAIN", "SASL-LOGIN", "SASL-CRAM-MD5", or "APOP". Defaults to "USER", passdb, unpwdb.passlimit, unpwdb.timelimit, unpwdb.userlimit, userdb See the...

McAfee Encrypted USB Manager Remote Security Bypass Vulnerability

The host is running McAfee Encrypted USB Manager, which is prone to sensitive information disclosure vulnerability. OpenVAS Vulnerability Test $Id: secpodmcafeeencryptusbmngrsecbypassvuln900026.nasl 5370 2017-02-20 15:24:26Z cfi $ Description: McAfee Encrypted USB Manager Remote Security Bypass...

McAfee加密USB管理器远程安全绕过漏洞

BUGTRAQ ID:30630 CNCAN ID：CNCAN-2008081202 McAfee Encrypted USB Manager是一款采用强大的加密技术，并结合强式存取控制方法来保护资料的解决方案。 McAfee Encrypted USB Manager存在安全绕过问题，远程攻击者可以利用漏洞执行离线攻击尝试猜测密码。 此漏洞只存在于当密码"Re-use Threshold"策略设置为非零值才有效，目前没有详细漏洞细节提供。 0 McAfee Encrypted USB Manager 3.1 0 升级到最新版本： McAfee Encrypted USB Manager...

CVE-2004-2760

sshd in OpenSSH 3.5p1, when PermitRootLogin is disabled, immediately closes the TCP connection after a root login attempt with the correct password, but leaves the connection open after an attempt with an incorrect password, which makes it easier for remote attackers to guess the password by...

Default credentials

BEA WebLogic Server and Express 7.0 through 10.0 allows remote attackers to conduct brute force password guessing attacks, even when account lockout has been activated, via crafted URLs that indicate whether a guessed password is successful or not...

CVE-2008-0901

BEA WebLogic Server and Express 7.0 through 10.0 allows remote attackers to conduct brute force password guessing attacks, even when account lockout has been activated, via crafted URLs that indicate whether a guessed password is successful or not...

CVE-2008-0901

BEA WebLogic Server and Express versions 7.0–10.0 are affected by a vulnerability that allows remote attackers to perform brute-force password guessing even when account lockout is enabled. The issue involves crafted URLs that reveal whether a guessed password is correct, enabling iterative guess...

CVE-2007-3279

PostgreSQL 8.1 and probably later versions, when the PL/pgSQL plpgsql language has been created, grants certain plpgsql privileges to the PUBLIC domain, which allows remote attackers to create and execute functions, as demonstrated by functions that perform local brute-force password guessing...

CVE-2007-3279

PostgreSQL 8.1 and probably later versions, when the PL/pgSQL plpgsql language has been created, grants certain plpgsql privileges to the PUBLIC domain, which allows remote attackers to create and execute functions, as demonstrated by functions that perform local brute-force password guessing...

CVE-2007-1558

The APOP protocol allows remote attackers to guess the first 3 characters of a password via man-in-the-middle MITM attacks that use crafted message IDs and MD5 collisions. NOTE: this design-level issue potentially affects all products that use APOP, including 1 Thunderbird 1.x before 1.5.0.12 and...

Code injection

The APOP protocol allows remote attackers to guess the first 3 characters of a password via man-in-the-middle MITM attacks that use crafted message IDs and MD5 collisions. NOTE: this design-level issue potentially affects all products that use APOP, including 1 Thunderbird 1.x before 1.5.0.12 and...

CVE-2007-1558

The APOP protocol allows remote attackers to guess the first 3 characters of a password via man-in-the-middle MITM attacks that use crafted message IDs and MD5 collisions. NOTE: this design-level issue potentially affects all products that use APOP, including 1 Thunderbird 1.x before 1.5.0.12 and...

CVE-2007-1558

The APOP protocol allows remote attackers to guess the first 3 characters of a password via man-in-the-middle MITM attacks that use crafted message IDs and MD5 collisions. NOTE: this design-level issue potentially affects all products that use APOP, including 1 Thunderbird 1.x before 1.5.0.12 and...