CVE-2006-6722

Bandwebsite aka Bandsite portal system 1.5 allows remote attackers to create administrative accounts via a direct request to admin.php with the Login parameter set to 1...

CVE-2006-6683

Pedro Lineu Orso chetcpasswd 2.4.1 and earlier verifies and updates user accounts via custom code that processes /etc/shadow and does not follow the PAM configuration, which might allow remote attackers to bypass intended restrictions implemented through PAM...

CVE-2006-6221

2X ThinClientServer Enterprise Edition before 4.0.2248 allows remote attackers to create multiple privileged accounts via a replay attack using the initial account creation request...

CVE-2006-6221

2X ThinClientServer Enterprise Edition before 4.0.2248 allows remote attackers to create multiple privileged accounts via a replay attack using the initial account creation request...

CVE-2006-6221

2X ThinClientServer Enterprise Edition prior to 4.0.2248 is vulnerable: an unauthenticated remote attacker can trigger a replay of the initial account creation request to create multiple administrative accounts. Root cause is an unauthenticated, replayable account-creation flow that allows adding...

CVE-2006-6221: Undefined Security Weakness

2X ThinClientServer Enterprise Edition before 4.0.2248 allows remote attackers to create multiple privileged accounts via a replay attack using the initial account creation request...

Chetcpasswd 2.x: multiple vulnerabilities

From Debian.org: "chetpasswd uses the HTTPXFORWARDEDFOR for authentication purposes.... Obviously, HTTPXFORWARDEDFOR is not a trusted variable, and can be spoofed by any scriptkiddie who can read the man page of wget .... Furthermore, this cgi script doesn't seem to implement any rate limiting fo...

CVE-2006-5909

generaloptions.php in Paul Tarjan Stanford Conference And Research Forum SCARF before 20070227 does not require the admin privilege, which allows remote attackers to reconfigure the application or its user accounts...

CVE-2006-5909

CVE-2006-5909 concerns Paul Tarjan’s Stanford Conference And Research Forum (SCARF) prior to 20070227. The vulnerability is in generaloptions.php, which does not require admin privilege, allowing remote attackers to reconfigure the application or its user accounts. The available sources (NVD/NVD-...

DataWizard FTPXQ Default Accounts

The version of DataWizard FTPXQ that is installed on the remote host has one or more default accounts setup which can allow an attacker to read and / or write arbitrary files on the system. This script was written by Justin Seitz Per Justin : GPLv2 include"compat.inc"; if description set script...

CVE-2006-5597

join.asp in MiniHTTP Web Forum & File Server PowerPack 4.0 allows remote attackers to add or modify arbitrary user accounts via modified 1 frmMailBox and 2 frmUserPass parameters...

CVE-2006-5597

CVE-2006-5597 affects MiniHTTP Web Forum & File Server PowerPack 4.0. The join.asp endpoint is vulnerable to remote manipulation of user accounts via modified parameters (1) frmMailBox and (2) frmUserPass), allowing an attacker to add or modify arbitrary accounts. The description and references i...

CVE-2006-5597

join.asp in MiniHTTP Web Forum & File Server PowerPack 4.0 allows remote attackers to add or modify arbitrary user accounts via modified 1 frmMailBox and 2 frmUserPass parameters...

CVE-2006-5569

FtpXQ Server 3.0.1 installs with two default testing accounts, which allows remote attackers to read or write arbitrary files via unknown vectors. NOTE: the provenance of this information is unknown; the details are obtained from third party information...

CVE-2006-5569

FtpXQ Server 3.0.1 installs with two default testing accounts, which allows remote attackers to read or write arbitrary files via unknown vectors. NOTE: the provenance of this information is unknown; the details are obtained from third party information...

CVE-2006-5569: Undefined Security Weakness

FtpXQ Server 3.0.1 installs with two default testing accounts, which allows remote attackers to read or write arbitrary files via unknown vectors. NOTE: the provenance of this information is unknown; the details are obtained from third party information...

FtpXQ Server 3.01 - MKD Command Remote Overflow Denial of Service

FtpXQ Server 3.01 - MKD Command Remote Overflow Denial of Service // source: https://www.securityfocus.com/bid/20721/info DataWizard FtpXQ Server is prone to multiple remote vulnerabilities: - A remote denial-of-service issue occurs because the application fails to perform adequate bounds checks ...

Debian DSA-917-1 : courier - programming error

Patrick Cheong Shu Yang discovered that courier-authdaemon, the authentication daemon of the Courier Mail Server, grants access to accounts that are already deactivated. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from...

OpenSSH < 4.1.0p2 / 4.2 Timing Attack

Binary data 3787.prm...

CVE-2006-4394

A logic error in LoginWindow in Apple Mac OS X 10.4 through 10.4.7, allows network accounts without GUIds to bypass service access controls and log into the system using loginwindow via unknown vectors...