Security Bulletin: IBM has announced a release for IBM Security Identity Governance and Intelligence in response to multiple security vulnerabilities

Summary IBM has announced a release for IBM Security Identity Governance and Intelligence IGI in response to multiple security vulnerabilities. There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition, Version 8 and IBM® Runtime Environment Java™ Version 8 included in this release ...

Security Bulletin: IBM Data Server Driver for ODBC and CLI is affected by multiple vulnerabilities in the GSKit library

Summary IBM Data Server Driver for ODBC and CLI is affected by multiple vulnerabilities in the GSKit library. Vulnerability Details CVEID: CVE-2016-0705 DESCRIPTION: OpenSSL is vulnerable to a denial of service, caused by a double-free error when parsing DSA private keys. An attacker could exploi...

Security Bulletin: Multiple vulnerabilities in the IBM GSKit component of IBM Spectrum Protect (formerly Tivoli Storage Manager) Server

Summary There are multiple vulnerabilities in the IBM GSKit component of IBM Spectrum Protect formerly Tivoli Storage Manager Server. The IBM Spectrum Protect Server has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2016-0702 DESCRIPTION: OpenSSL could allow a local attacker to...

Security Bulletin: IBM QRadar SIEM has weak password requirements. (CVE-2016-9738)

Summary The product does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. Vulnerability Details CVEID: CVE-2016-9738 DESCRIPTION: IBM QRadar does not require that users should have strong passwords by default, which...

John the Ripper Password Cracker (Fast Mode)

This module uses John the Ripper to identify weak passwords that have been acquired as hashed files loot or raw LANMAN/NTLM hashes hashdump. The goal of this module is to find trivial passwords in a short amount of time. To crack complex passwords or use large wordlists, John the Ripper should be...

TIBCO DataSynapse GridServer Manager GridServer Broker, GridServer Driver and GridServer Engine Component Server Encryption Misuse Vulnerability

TIBCO DataSynapse GridServer Manager is a management system for managing GridServer environments from TIBCO Software, Inc. GridServer Broker is a workload management component; GridServer Driver is a driver component; GridServer Broker is a workload management component; GridServer Driver is a...

CVE-2017-1601

IBM Security Guardium 10.0, 10.0.1, and 10.1 through 10.1.4 Database Activity Monitor does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. IBM X-Force ID: 132624...

Micro Focus Novell eDirectory Password Restriction Vulnerability

Micro Focus Novell eDirectory is an identity management infrastructure platform that combines identity management architecture and directory services technology from Micro Focus, UK. The platform provides authentication policies, data backup and recovery services, and data disaster recovery. A...

Weak password and remote command execution vulnerability in Lenovo firewalls

LFW800E is a Gigabit intelligent firewall developed by Lenovo Skyworks Networks for medium-sized enterprise users' network security applications. The Lenovo firewall has weak password and remote command execution vulnerabilities, which can be exploited by an attacker to successfully log in to the...

Collection of 1.4 Billion Plain-Text Leaked Passwords Found Circulating Online

Hackers always first go for the weakest link to quickly gain access to your online accounts. Online users habit of reusing the same password across multiple services gives hackers opportunity to use the credentials gathered from a data breach to break into their other online accounts. Researchers...

IoT Devices: The Gift that Keeps on Giving… to Hackers

ARCHIVED STORY IoT Devices: The Gift that Keeps on Giving… to Hackers By Tim Hux · November 16, 2017 McAfee Advanced Threat Research onMost Hackable Gifts You’ve probably noticed the recent increase in Internet connected drones, digital assistants, toys, appliances and other devices hitting the...

CVE-2017-1221

IBM Tivoli Endpoint Manager IBM BigFix 9.2 and 9.5 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. IBM X-Force ID: 123861...

IBM BigFix Platform Information Disclosure Vulnerability (CNVD-2017-33742)

IBM BigFix platform is a dynamic set of IBM's integrated messaging content-driven and management system multi-technology platform. An information disclosure vulnerability exists in IBM BigFix Platform versions 9.5.4 and earlier and 9.2.9 and earlier, which stems from the program's failure to...

Semrush: Security misconfiguration "weak passwords".

The site has a security misconfiguration issue. The site accept weak passwords like "123" or "12345" or "abc12345" which can be guessed easily with the help of some auto attacks...

Code injection

Polycom RealPresence Resource Manager aka RPRM before 8.4 allows local users to have unspecified impact via vectors related to weak passwords...

CVE-2015-4681

Polycom RealPresence Resource Manager (RPRM) <= 8.3.x is vulnerable to CVE-2015-4681 (and related CVEs) via vectors related to weak passwords, enabling local access with complete impact on confidentiality, integrity, and availability. The SEC Consult advisory reports multiple vulnerabilities a...

CVE-2015-4681

Polycom RealPresence Resource Manager aka RPRM before 8.4 allows local users to have unspecified impact via vectors related to weak passwords...

Password Masking

Slashdot asks if password masking -- replacing password characters with asterisks as you type them -- is on the way out. I don't know if that's true, but I would be happy to see it go. Shoulder surfing, the threat is defends against, is largely nonexistent. And it is becoming harder to type in...

Over-authorized Access and Weak Password Vulnerabilities in the Integrated Management System for Meteorological Information in Modern Agricultural Parks of Chongqing Lanyu Tianshen Science and Technology Co.

Modern Agricultural Park Weather Information Integrated Management System is a weather system for agriculture. Over-authorized access and weak password vulnerabilities exist in the Integrated Management System for Meteorological Information in Modern Agricultural Parks of Chongqing Lanyu Tianshen...

CVE-2017-7903

A Weak Password Requirements issue was discovered in Rockwell Automation Allen-Bradley MicroLogix 1100 programmable-logic controllers 1763-L16AWA, Series A and B, Version 16.00 and prior versions; 1763-L16BBB, Series A and B, Version 16.00 and prior versions; 1763-L16BWA, Series A and B, Version...