CVE-2004-0082

The mksmbpasswd shell script mksmbpasswd.sh in Samba 3.0.0 and 3.0.1, when creating an account but marking it as disabled, may overwrite the user password with an uninitialized buffer, which could enable the account with a more easily guessable password...

[Full-Disclosure] PrimeBase SQL Database server cleartext password storage.

PrimeBase SQL Database server cleartext password storage. Vapid Labs Security Note 10/20/03 The PrimeBase SQL Database Server 4.2 stores passwords in clear text, and based on the installation users umask settings maybe readable by all local users. From the readme.txt file: "The Admin server will...

Default Password (db2as) for 'db2as' Account

The account 'db2as' has the password 'db2as'. An attacker may use it to gain further privileges on the system. %NASLMINLEVEL 70300 This script was written by Chris Foster See the Nessus Scripts License for details Changes by Tenable Add globalsettings/suppliedloginsonly scriptexcludekey 06/2015 A...

Default Password (db2fenc1) for 'db2fenc1' Account

The account 'db2fenc1' has the password 'db2fenc1'. An attacker may use this to gain further privileges on the system. %NASLMINLEVEL 70300 This script was written by Chris Foster See the Nessus Scripts License for details Changes by Tenable Add globalsettings/suppliedloginsonly scriptexcludekey...

Default Password (ibmdb2) for 'db2inst1' Account

The account 'db2inst1' has the password 'ibmdb2'. An attacker may use this to gain further privileges on this system. %NASLMINLEVEL 70300 This script was written by Chris Foster See the Nessus Scripts License for details Changes by Tenable Add globalsettings/suppliedloginsonly scriptexcludekey...

CVE-2003-0343

BlackMoon FTP Server 2.6 Free Edition, and possibly other distributions and versions, generates an "Account does not exist" error message when an invalid username is entered, which makes it easier for remote attackers to conduct brute force attacks...

Default Password (root) for 'root' Account

The account 'root' on the remote host has the password 'root'. An attacker may leverage this issue to gain total control of the affected system. Note that, while SKIDATA Freemotion.Gate controllers are known to use these credentials, this plugin reports any time it finds a host using these...

Unpassworded 'date' Account

The account 'date' has no password set. An attacker can leverage this to gain access to the system. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if description scriptid11248; scriptversion"1.37";...

Default Password (satori) for 'rewt' Account

The account 'rewt' has the password 'satori'. An attacker may use this to gain further privileges on this system. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. account = "rewt"; password = "satori"; include'deprecatednasllevel.inc'; include'compat.inc'; if description scriptid11265;...

Default Password (wank) for 'wank' Account

The account 'wank' has the password 'wank'. An attacker may use this to gain further privileges on this system. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. account = "wank"; password = "wank"; include'deprecatednasllevel.inc'; include'compat.inc'; if description scriptid11260;...

Security holes : Ultimate PHP Board

Product : Ultimate PHP Board http://xcrew.host.sk Versions : 1.0 Beta 1.1 Problems : 1.0 B : - Reading of privates messages 1.1 & 1.0 B : - Access to users/admins accounts Exploits : 1.0 B : - /members/ID.pm - /members/ID.xbb 1.1 : - imgjavascript:window.open' index.php?...

Microsoft SQL Server and Microsoft Data Engine (MSDE) ship with a null default password

Overview Microsoft SQL Server and Microsoft Data Engine ship with a null default password on the administrative account sa. If the system administrator does not set the password, the system may be vulnerable to attack. Description Microsoft SQL Server MS SQL and Microsoft Data Engine MSDE ship...

Vulnerability in Amtote International homebet self service wagering system.

Product Description: Internet-based account wagering interface utilizing HTML and JAVA web based applications. The HTML functionality includes viewing current account balances, viewing current odds by track, placing wagers, reviewing wagers, and viewing official results/prices by track. The JAVA...

CVE-2000-0772

The CVE-2000-0772 entry concerns Tumbleweed Messaging Management System (MMS) 4.6 and earlier (formerly Worldtalk Worldsecure) that creates a default account named “sa” with no password, enabling unauthenticated access. The NVD entry attributes a CVSSv2 base score of 7.5 (HIGH) with network attac...

CVE-1999-0585

A Windows NT administrator account has the default name of Administrator...

Standard & Poor's ComStock MultiCSP Detection

The remote host seems to be a Standard & Poor's MultiCSP system. Make sure only authorized systems can connect to it. In addition, these units ship with several default accounts with a blank or easily guessed password. However, Nessus has not checked for these. %NASLMINLEVEL 70300 C Tenable Netwo...

CVE-1999-0502

A Unix account has a default, null, blank, or missing password...

CVE-1999-0501

CVE-1999-0501 describes a Unix account with a guessable password. The connected sources (e.g., Red Hat CVE entry and OpenVAS NASL scripts) confirm it is discussed as a default/guessable credential issue across multiple services (FTP/Telnet/SSH, etc.). Root cause per the description is use of a gu...

CVE-1999-1324

VAXstations running Open VMS 5.3 through 5.5-2 with VMS DECwindows or MOTIF do not properly disable access to user accounts that exceed the break-in limit threshold for failed login attempts, which makes it easier for attackers to conduct brute force password guessing...

slackware7.login.txt

Hi, Below I describe a bug in Slackware 7.0. I did notify [email protected] about a week ago and thought that it was about time to send the bug report to bugtraq. This is regarding a logic but in the shadow suite that enables a brute force attack for finding and cracking login in accounts via...