FreeBSD-SA-02:14.pam-pgsql

-----BEGIN PGP SIGNED MESSAGE----- ============================================================================= FreeBSD-SA-02:14 Security Advisory FreeBSD, Inc. Topic: pam-pgsql port authentication bypass Category: ports Module: pam-pgsql Announced: 2002-03-12 Credits: Jacques A. Vidrine Affects...

Проблемы с блокирвоанными пользователями в Cisco Secure ACS (protection bypass)

Пользователи с блокирвоанными учетными записями NDS могут войти в систему...

Учетные записи miramail в открытом тексте (weak encryption)

Учетные записи пользователей хранятся в открытом тексте...

PT-2001-2573 · Opie · One-Time Passwords In Everything

Name of the Vulnerable Software and Affected Versions: One-Time Passwords In Everything a.k.a OPIE versions 2.32 through 2.4 Description: The issue allows remote attackers to determine the existence of user accounts. This is achieved by the system printing random passphrases if the user account...

Доступ к пользовательским учетным записям в CentraOne (information leakage)

Учетный записи пользователей содержатся в открытом на чтение лог-файле...

MS SQL 7.0 DTS saved packages contain plain text passwords

When creating a Data Transformation Service DTS Package be carefull. The saved file does not encrypt the passwords that the package will use when executed. If a client could convice an admin to create an example DTS package for troubleshooting then the client would have the admin's SQL password. ...

macosxsetuidroot.txt

Dump to text file if you find easier. http://www.securemac.com/macosxsetuidroot.php Operating System: Max OS X Version Affected: up to 10.1 Security Risk: High Remote: No Fixed: No About: Mac OS X over the past few months have started to splout security concerns, this being one of the first most...

Solaris in.fingerd Unused Accounts Disclosure

The remote Solaris finger daemon will return a list of accounts that have never been used when it receives the request : finger 'a b c d e f g h'@target A remote attacker could use this information to guess which operating system is running, or to mount further attacks on these accounts. C Tenabl...

CVE-2001-1280

POP3 Server for Ipswitch IMail 7.04 and earlier generates different responses to valid and invalid user names, which allows remote attackers to determine users on the system...

Amtote Homebet - Account Information Brute Force

Amtote Homebet - Account Information Brute Force source: https://www.securityfocus.com/bid/3371/info Homebet is an internet based betting application that is developed by Amtote International. A vulnerability exists in Homebet which could enable a non-registered user to confirm the validity of...

CVE-2001-0347

Information disclosure vulnerability in Microsoft Windows 2000 telnet service allows remote attackers to determine the existence of user accounts such as Guest, or log in to the server without specifying the domain name, via a malformed userid...

CVE-2001-0335

FTP service in IIS 5.0 and earlier allows remote attackers to enumerate Guest accounts in trusted domains by preceding the username with a special sequence of characters...

Microsoft IIS FTP service searches all trusted domains for user accounts

Overview The Microsoft IIS FTP Service contains a vulnerability that allows remote attackers to log in using domain accounts without providing a specific domain name. Description The Microsoft IIS FTP Service allows users to establish connections using either local accounts or Windows domain...

CVE-1999-1170

IPswitch IMail allows local users to gain additional privileges and modify or add mail accounts by setting the "flags" registry key to 1920...

CVE-1999-1071

CVE-1999-1071 affects Excite for Web Servers (EWS) 1.1. The Architext.conf authentication file is installed with world-writable permissions, allowing local users to modify the file and gain access to Excite accounts. Root cause: insecure file permissions on the authentication file. Impact: confid...

CVE-1999-1171

IPswitch WSFTP allows local users to gain additional privileges and modify or add mail accounts by setting the "flags" registry key to 1920...

CVE-1999-1171

IPswitch WS_FTP contains a local privilege escalation flaw: by setting the flags registry key to 1920, a local user can gain additional privileges and modify or add mail accounts. The PT-1999-1600 entry confirms this issue but does not specify affected versions, and the original CVE description m...

CVE-2001-0553

SSH Secure Shell 3.0.0 on Unix systems does not properly perform password authentication to the sshd2 daemon, which allows local users to gain access to accounts with short password fields, such as locked accounts that use "NP" in the password field...

ISSalert: ISS Alert: SSH Secure Shell Authentication Bypass Vulnerability

TO UNSUBSCRIBE: email "unsubscribe alert" in the body of your message to [email protected] Contact [email protected] for help with any problems! --------------------------------------------------------------------------- -----BEGIN PGP SIGNED MESSAGE----- Internet Security Systems Security Aler...

CVE-2001-0347

Information disclosure vulnerability in Microsoft Windows 2000 telnet service allows remote attackers to determine the existence of user accounts such as Guest, or log in to the server without specifying the domain name, via a malformed userid...