9356 matches found
Exploiting Skype: Building a telephone botnet
From the Industry Standard Robert McMillan Flaws in popular Internet-based telephony systems could be exploited to create a network of hacked phone accounts, somewhat like the botnets that have been wreaking havoc with PCs for the past few years. Researchers at Secure Science recently discovered...
CVE-2009-1289
private/login.ssi in the Advanced Management Module AMM on the IBM BladeCenter, including the BladeCenter H with BPET36H 54, allows remote attackers to discover the access roles and scopes of arbitrary user accounts via a modified WEBINDEX parameter...
Code injection
mailPage.asp in QuickerSite 1.8.5 allows remote attackers to flood e-mail accounts with messages via a large number of requests with a modified sEmail parameter...
CVE-2008-6674
mailPage.asp in QuickerSite 1.8.5 allows remote attackers to flood e-mail accounts with messages via a large number of requests with a modified sEmail parameter...
CVE-2008-6674
mailPage.asp in QuickerSite 1.8.5 allows remote attackers to flood e-mail accounts with messages via a large number of requests with a modified sEmail parameter...
Asterisk VoIP server user accounts enumeration
Different replies for non-exstant SIP account and invalid password...
Sun Java System Identity Manager / Access Manager accounts enumeration
Replies for invalid username and invalid password are different...
Cross site request forgery (csrf)
Cross-site request forgery CSRF vulnerability in html/admin.php in TorrentFlux 2.3 allows remote attackers to hijack the authentication of administrators for requests that add new accounts via the addUser action...
CVE-2008-6585
Cross-site request forgery CSRF vulnerability in html/admin.php in TorrentFlux 2.3 allows remote attackers to hijack the authentication of administrators for requests that add new accounts via the addUser action...
CVE-2008-6577
Nortel MG1000S, Signaling Server, and Call Server on the Communications Server 1000 CS1K 4.50.x contain multiple unspecified hard-coded accounts and passwords, which allows remote attackers to gain privileges...
Hardcoded credentials
Nortel MG1000S, Signaling Server, and Call Server on the Communications Server 1000 CS1K 4.50.x contain multiple unspecified hard-coded accounts and passwords, which allows remote attackers to gain privileges...
CVE-2008-6577
CVE-2008-6577 affects Nortel MG1000S, Signaling Server, and Call Server on the Communications Server 1000 (CS1K) 4.50.x. The root cause is unspecified hard-coded accounts and passwords, which allow remote attackers to gain privileges over the network with no authentication. Base metrics indicate ...
CVE-2008-6577
Nortel MG1000S, Signaling Server, and Call Server on the Communications Server 1000 CS1K 4.50.x contain multiple unspecified hard-coded accounts and passwords, which allows remote attackers to gain privileges...
Authentication flaw
microcms-admin-home.php in Implied by Design Micro CMS Micro-CMS 3.5 aka 0.3.5 does not require authentication as an administrator, which allows remote attackers to 1 create administrative accounts via an addadmin action, 2 remove administrative accounts via a deleteadmin action, and 3 modify...
CVE-2008-6553
microcms-admin-home.php in Implied by Design Micro CMS Micro-CMS 3.5 aka 0.3.5 does not require authentication as an administrator, which allows remote attackers to 1 create administrative accounts via an addadmin action, 2 remove administrative accounts via a deleteadmin action, and 3 modify...
CVE-2008-6553
microcms-admin-home.php in Implied by Design Micro CMS Micro-CMS 3.5 aka 0.3.5 does not require authentication as an administrator, which allows remote attackers to 1 create administrative accounts via an addadmin action, 2 remove administrative accounts via a deleteadmin action, and 3 modify...
Family Connection 1.8.1 SQL Injection
Salvatore "drosophila" Fresta + Application: Family Connection + Version: 1.8.1 + Website: http://www.familycms.com + Bugs: A Multiple SQL Injection B Create Admin User C Blind SQL Injection + Exploitation: Remote + Date: 25 Mar 2009 + Discovered by: Salvatore "drosophila" Fresta + Author:...
CVE-2009-1083
Sun Java System Identity Manager IdM 7.0 through 8.0 on Linux, AIX, Solaris, and HP-UX permits "control characters" in the passwords of user accounts, which allows remote attackers to execute arbitrary commands via vectors involving "resource adapters."...
Shadow: Privilege escalation
Background Shadow is a set of tools to deal with user accounts. Description Paul Szabo reported a race condition in the "login" executable when setting up tty permissions. Impact A local attacker belonging to the "utmp" group could use symlink attacks to overwrite arbitrary files and possibly gai...