CWE-1391 Archives - CVE Vulnerability

CVE-2020-8632

Sun, 26 Feb 2023 06:43:28 +0000

In cloud-init through 19.4, rand_user_password in cloudinit/config/cc_set_passwords.py has a small default pwlen value, which makes it easier for attackers to guess passwords.

The post CVE-2020-8632 appeared first on CVE Vulnerability.

CVE-2020-5365

Sun, 26 Feb 2023 06:42:18 +0000

Dell EMC Isilon versions 8.2.2 and earlier contain a remotesupport vulnerability. The pre-configured support account, remotesupport, is bundled in the Dell EMC Isilon OneFS installation. This account is used for diagnostics and other support functions. Although the default password is different for every cluster, it is predictable.

The post CVE-2020-5365 appeared first on CVE Vulnerability.

CVE-2020-5248

Sun, 26 Feb 2023 06:42:15 +0000

GLPI before before version 9.4.6 has a vulnerability involving a default encryption key. GLPIKEY is public and is used on every instance. This means anyone can decrypt sensitive data stored using this key. It is possible to change the key before installing GLPI. But on existing instances, data must be reencrypted with the new key. Problem is we can not know which columns or rows in the database are using that; espcially from plugins. Changing the key without updating data would lend in bad password sent from glpi; but storing them again from the UI will work.

The post CVE-2020-5248 appeared first on CVE Vulnerability.

CVE-2020-27020

Sun, 26 Feb 2023 06:40:13 +0000

Password generator feature in Kaspersky Password Manager was not completely cryptographically strong and potentially allowed an attacker to predict generated passwords in some cases. An attacker would need to know some additional information (for example, time of password generation).

The post CVE-2020-27020 appeared first on CVE Vulnerability.

CVE-2022-29965

godfreyd94 — Thu, 23 Feb 2023 05:18:33 +0000

The Emerson DeltaV Distributed Control System (DCS) controllers and IO cards through 2022-04-29 misuse passwords. Access to privileged operations on the maintenance port TELNET interface (23/TCP) on M-series and SIS (CSLS/LSNB/LSNG) nodes is controlled by means of utility passwords. These passwords are generated using a deterministic, insecure algorithm using a single seed value composed of a day/hour/minute timestamp with less than 16 bits of entropy. The seed value is fed through a lookup table and a series of permutation operations resulting in three different four-character passwords corresponding to different privilege levels. An attacker can easily reconstruct these passwords and thus gain access to privileged maintenance operations. NOTE: this is different from CVE-2014-2350.

The post CVE-2022-29965 appeared first on CVE Vulnerability.