Ubuntu 9.10 : grub2 vulnerability (USN-868-1)

It was discovered that GRUB 2 did not properly validate passwords. An attacker with physical access could conduct a brute-force attack and bypass authentication by submitting a 1 character password. Note that Tenable Network Security has extracted the preceding description block directly from the...

CVE-2012-2368

Bytemark Symbiosis before Revision 1322 does not properly validate passwords, which allows remote attackers to gain access to email accounts via an arbitrary password...

Default credentials

Bytemark Symbiosis before Revision 1322 does not properly validate passwords, which allows remote attackers to gain access to email accounts via an arbitrary password...

CVE-2012-2368

Bytemark Symbiosis prior to Revision 1322 is vulnerable: it does not properly validate passwords, allowing remote attackers to access email accounts with arbitrary passwords. A fix is available in Revision 1322; systems should update to that revision or apply provided mitigations as per linked ad...

CVE-2012-2368

Bytemark Symbiosis before Revision 1322 does not properly validate passwords, which allows remote attackers to gain access to email accounts via an arbitrary password...

WinRadius Server 2009 - Denial of Service

WinRadius Server 2009 - Denial of Service Title: WinRadius Server Denial Of Service Vulnerability Software : WinRadius Software Version : v2009 Vendor: http://www.elite-school.com/saas/WinRadius/ Vulnerability Published : 2012-05-27 Vulnerability Update Time : Status : Impact : MediumCVSS2 Base :...

WinRadius Server 2009 - Denial of Service

Title: WinRadius Server Denial Of Service Vulnerability Software : WinRadius Software Version : v2009 Vendor: http://www.elite-school.com/saas/WinRadius/ Vulnerability Published : 2012-05-27 Vulnerability Update Time : Status : Impact : MediumCVSS2 Base : 5.0, AV:N/AC:L/Au:N/C:N/I:N/A:P Bug...

正方教务管理系统web端补考成绩录入漏洞

简要描述： web端成绩录入可绕过密码验证录入补考成绩。 详细说明： 此漏洞与 WooYun: 正方教务管理系统web端成绩录入漏洞 类似。 web端在进行成绩录入时可以通过直接将动态页面从jscjmm.aspx修改为xfjsbkcjlr.aspx进行绕过，只要具有教师的登录权限，不需要验证成绩录入密码即可直接进入成绩的录入和提交页面。 我写了一个脚本用于测试我所在学校的教师账户，发现有几百个教师账户仍旧使用默认账户密码，如果通过此漏洞将造成巨大影响，我也准备将所收集的资料上报校方处理。 漏洞证明： 此漏洞与 WooYun: 正方教务管理系统web端成绩录入漏洞 类似，就不再截图证明了。...

Stack overflow

Stack-based buffer overflow in the password-validation functionality in Directory Services in Apple Mac OS X 10.5.8 and 10.6.x before 10.6.5 allows remote attackers to execute arbitrary code or cause a denial of service application crash via unspecified vectors...

CVE-2010-1840

Stack-based buffer overflow in the password-validation functionality in Directory Services in Apple Mac OS X 10.5.8 and 10.6.x before 10.6.5 allows remote attackers to execute arbitrary code or cause a denial of service application crash via unspecified vectors...

Confluence features that require password confirmation (websudo, captcha) do not work with custom authentication

When user is required to confirm the password, Confluence always checks the entered password against the internally stored user/password. If an instance is configured to use custom authentication which is different from atlassian-user, the password validation will fail. h3. Resolution This is fix...

Apple Releases Security Update 2010-006

Apple has released security update 2010-006 for Mac OS X and Mac OS X Server to address a vulnerability in the AFP package. This vulnerability may allow an attacker to bypass password validation and obtain sensitive information. The article indicates that this vulnerability does not affect system...

Nokia E72 smartphone protection bypass

Keyboard is not locked during password validation...

Apache CouchDB timing attack

Password validation algorythm allows to guess matching part...

Design/Logic Flaw

Kingston DataTraveler BlackBox DTBB, DataTraveler Secure Privacy Edition DTSP, and DataTraveler Elite Privacy Edition DTEP USB flash drives validate passwords with a program running on the host computer rather than the device hardware, which allows physically proximate attackers to access the...

Design/Logic Flaw

Verbatim Corporate Secure and Corporate Secure FIPS Edition USB flash drives validate passwords with a program running on the host computer rather than the device hardware, which allows physically proximate attackers to access the cleartext drive contents via a modified program...

CVE-2010-0221

Kingston DataTraveler BlackBox DTBB, DataTraveler Secure Privacy Edition DTSP, and DataTraveler Elite Privacy Edition DTEP USB flash drives validate passwords with a program running on the host computer rather than the device hardware, which allows physically proximate attackers to access the...

Design/Logic Flaw

SanDisk Cruzer Enterprise USB flash drives validate passwords with a program running on the host computer rather than the device hardware, which allows physically proximate attackers to access the cleartext drive contents via a modified program...

CVE-2010-0221

Kingston DataTraveler BlackBox DTBB, DataTraveler Secure Privacy Edition DTSP, and DataTraveler Elite Privacy Edition DTEP USB flash drives validate passwords with a program running on the host computer rather than the device hardware, which allows physically proximate attackers to access the...

CVE-2010-0224

The CVE-2010-0224 entry concerns SanDisk Cruzer Enterprise USB flash drives. Affected component: the authentication/password validation conducted by a program running on the host computer instead of the drive’s hardware. Root cause: password verification occurs outside the device hardware, enabli...