CWE-327 Archives - CVE Vulnerability

CVE-2008-3775

Sun, 26 Feb 2023 09:10:11 +0000

Folder Lock 5.9.5 and earlier uses weak encryption (ROT-25) for the password, which allows local administrators to obtain sensitive information by reading and decrypting the QualityControl_pack registry value.

The post CVE-2008-3775 appeared first on CVE Vulnerability.

CVE-2008-3188

Sun, 26 Feb 2023 09:09:53 +0000

libxcrypt in SUSE openSUSE 11.0 uses the DES algorithm when the configuration specifies the MD5 algorithm, which makes it easier for attackers to conduct brute-force attacks against hashed passwords.

The post CVE-2008-3188 appeared first on CVE Vulnerability.

CVE-2007-6013

Sun, 26 Feb 2023 09:07:58 +0000

WordPress 1.5 through 2.3.1 uses cookie values based on the MD5 hash of a password MD5 hash, which allows attackers to bypass authentication by obtaining the MD5 hash from the user database, then generating the authentication cookie from that hash.

The post CVE-2007-6013 appeared first on CVE Vulnerability.

CVE-2007-5460

Sun, 26 Feb 2023 09:07:41 +0000

Microsoft ActiveSync 4.1, as used in Windows Mobile 5.0, uses weak encryption (XOR obfuscation with a fixed key) when sending the user’s PIN/Password over the USB connection from the host to the device, which might make it easier for attackers to decode a PIN/Password obtained by (1) sniffing or (2) spoofing the docking process.

The post CVE-2007-5460 appeared first on CVE Vulnerability.

CVE-2007-4150

Sun, 26 Feb 2023 09:07:05 +0000

The Visionsoft Audit on Demand Service (VSAOD) in Visionsoft Audit 12.4.0.0 uses weak cryptography (XOR) when (1) transmitting passwords, which allows remote attackers to obtain sensitive information by sniffing the network; and (2) storing passwords in the configuration file, which allows local users to obtain sensitive information by reading this file.

The post CVE-2007-4150 appeared first on CVE Vulnerability.

CVE-2018-7959

Sun, 26 Feb 2023 06:51:14 +0000

There is a short key vulnerability in Huawei eSpace product. An unauthenticated, remote attacker launches man-in-the-middle attack to intercept and decrypt the call information when the user enables SRTP to make a call. Successful exploitation may cause sensitive information leak.

The post CVE-2018-7959 appeared first on CVE Vulnerability.

CVE-2018-7211

Sun, 26 Feb 2023 06:50:59 +0000

An issue was discovered in iDashboards 9.6b. The SSO implementation is affected by a weak obfuscation library, allowing man-in-the-middle attackers to discover credentials.

The post CVE-2018-7211 appeared first on CVE Vulnerability.

CVE-2018-6829

Sun, 26 Feb 2023 06:50:50 +0000

cipher/elgamal.c in Libgcrypt through 1.8.2, when used to encrypt messages directly, improperly encodes plaintexts, which allows attackers to obtain sensitive information by reading ciphertext data (i.e., it does not have semantic security in face of a ciphertext-only attack). The Decisional Diffie-Hellman (DDH) assumption does not hold for Libgcrypt’s ElGamal implementation.

The post CVE-2018-6829 appeared first on CVE Vulnerability.

CVE-2018-6619

Sun, 26 Feb 2023 06:50:47 +0000

Easy Hosting Control Panel (EHCP) v0.37.12.b makes it easier for attackers to crack database passwords by leveraging use of a weak hashing algorithm without a salt.

The post CVE-2018-6619 appeared first on CVE Vulnerability.

CVE-2018-6402

Sun, 26 Feb 2023 06:50:42 +0000

Ecobee Ecobee4 4.2.0.171 devices can be forced to deauthenticate and connect to an unencrypted Wi-Fi network with the same SSID, even if the device settings specify use of encryption such as WPA2, as long as the competing network has a stronger signal. An attacker must be able to set up a nearby SSID, similar to an “Evil Twin” attack.

The post CVE-2018-6402 appeared first on CVE Vulnerability.