Applied Watch Command Center 1.0 - Authentication Bypass (1)

Applied Watch Command Center 1.0 - Authentication Bypass 1 // source: https://www.securityfocus.com/bid/9124/info A vulnerability has been identified in the system that may allow an attacker to bypass authentication to add attacker supplied IDS alerts and new user accounts in the console...

Poster.Version:Two Setup Vulnerability

Author: DarkKnight My site: http://www.insecureonline.com Product: Poster.version:two Side Note: This is my first post ever on bugtraq, so bear with me. Vendors: Contacted A vulnerability exists within Poster.version:two that allows a remote attacker to add accounts to a Poster.version:two. The...

Drupal XSS Vulnerability (main page and sub pages)

------------------------------------------------------ Drupal XSS Vulnerability main page and sub pages ------------------------------------------------------ Any kind of XSS attacks possibility. An attacker could access other users/admin drupal accounts...

ICQ Pro 2003a Password Bypass exploit (ca1-icq.asm)

No description provided by source. ; ; CUT HERE - CUTE HERE - ca1-icq.asm - CUT HERE - CUT HERE BOF ; ------------------------------------------------------------------------- ; ; 07/02/2003 - ca1-icq.asm ; ICQ Password Bypass exploit. ; written by Caua Moura Prado aka ca1 ; ; This exploit allows...

CVE-2003-0304

one||zero aka One or Zero Helpdesk 1.4 rc4 allows remote attackers to create administrator accounts by directly calling the install.php Helpdesk Installation script...

CVE-2003-0304

The CVE-2003-0304 entry concerns One||Zero Helpdesk 1.4 rc4, where remote attackers can create administrator accounts by directly invoking the Helpdesk Installation script (install.php). The vulnerability arises from improper handling of installation script execution, enabling privilege escalatio...

hotmailpassport.txt

Hotmail & Passport .NET Accounts Vulnerability There is a very serious and stupid vulnerability or badcoding in Hotmail / Passport’s .NET Accounts I tried sending emails several times to Hotmail / Passport contact addresses, but always met with the NLP bots. I guess I don’t need to go in details ...

IBM AIX "secldapclntd" daemon authentication vulnerability

Overview A vulnerability in the secldapclntd daemon in IBM's AIX operating system could allow unauthorized remote users to modify accounts on the system. Description According to the IBM bulletin for this issue:"The secldapclntd daemon accepts requests from the LDAP load module, forwards requests...

Sambar Server Default Accounts

The Sambar web server comes with some default accounts. It is possible to log in as some of them without password. An attacker may use this flaw to alter the content of this server. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid11493; scriptversion"1.18";...

PHP-Nuke 5.6/6.x News Module - 'article.php' SQL Injection

source: https://www.securityfocus.com/bid/7172/info It has been reported that an input validation error exists in the article.php file included with PHPNuke as part of the News module. Because of this, an attacker could send a malicious string through PHPNuke that would allow the attacker to...

Unpassworded 'jack' Account

The account 'jack' has no password set. An attacker may use this to gain further privileges on this system. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. account = "jack"; include'deprecatednasllevel.inc'; include'compat.inc'; if description scriptid11249; scriptversion"1.35";...

List Site Pro 2.0 - User Database Delimiter Injection

source: https://www.securityfocus.com/bid/6685/info List Site PRO is a top site ranking system that counts hits from member sites and then ranks them according to the number of hits. A problem has been reported for List Site PRO that would allow an attacker to inject arbitrary values via html inp...

Apache Tomcat Default Accounts

This host appears to be the running the Apache Tomcat Servlet engine with the default accounts still configured. A potential intruder could reconfigure this service in a way that grants system access. %NASLMINLEVEL 70300 This script was written by Orlando Padilla See the Nessus Scripts License fo...

CVE-2002-1936

UTStarcom BAS 1000 3.1.10 creates several default or back door accounts and passwords, which allows remote attackers to gain access via 1 field account with a password of "field", 2 guru account with a password of "3noguru", 3 snmp account with a password of "snmp", or 4 dbase account with a...

CVE-2002-1748

Unknown vulnerability in Slash 2.1.x and 2.2 through 2.2.2, as used in Slashcode, allows remote authenticated users to gain access to arbitrary accounts...

CVE-2002-1691

Alcatel OmniPCX 4400 installs known user accounts and passwords in the /etc/password file by default, which allows remote attackers to gain unauthorized access...

PT-2002-2406 · Newsreactor · Newsreactor

Name of the Vulnerable Software and Affected Versions: NewsReactor version 1.0 Description: The issue is related to a weak encryption scheme used by the software, which could allow local users to decrypt passwords and gain access to other users' newsgroup accounts. Recommendations: For NewsReacto...

SPGpartenaires (PHP)

Informations : °°°°°°°°°°°°°° Version : ? - 3.0.1 Website : http://www.scripts-php-gratuits.com Problem : SQL Injection - Access to member's accounts PHP Code/Location : °°°°°°°°°°°°°°°°°°° modif/ident.php : -------------------------------------------------- ... $sql="SELECT nomsite FROM...

MySQL 3.23.x/4.0.x - 'COM_CHANGE_USER' Password Length Account

/ source: https://www.securityfocus.com/bid/6373/info A flaw in the password authentication mechanism for MySQL may make it possible for an authenticated database user to compromise the accounts of other database users. The flaw lies in the fact that the server uses a string returned by the clien...

NOVL-2002-2963767 - Remote Manager Security Issue - eDir 8.6.2

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 For Immediate Disclosure ============================== Summary ============================== Security Alert: NOVL-2002-2963767 Title: Remote Manager Security Issue - eDir 8.6.2 Date: 22-Oct-2002 Revision: Original Product Name: Novell eDirectory 8.6...