CVE-2003-1456

Album.pl 6.1 allows remote attackers to execute arbitrary commands, when an alternative configuration file is used, via unknown attack vectors...

efileman-multi.txt

Software : eFileman Version : 7.x tested on 7.1.0.87-88 Found by : Xcross87 A. Remote File Upload Vulnerability : Xploit : http://victim.com/path/upload.html http://victim.com/path/cgi-bin/efileman/upload.cgi The uploaded files are stored in : http://victim.com/path/uploads/uploadfile.xxx B. Dire...

MagniComp SysInfo Agent Accessible

The MagniComp SysInfo agent on the remote host allows the Nessus server to retrieve information about the system's assets and configuration, which could help an attacker plan more focused attacks against the affected host. C Tenable Network Security, Inc. include"compat.inc"; if description...

CVE-2004-2708

Gyach Enhanced Gyach-E before 1.0.0 stores passwords in plaintext, which allows attackers to obtain user passwords by reading the configuration file...

CVE-2004-2708

Gyach Enhanced (Gyach-E) before 1.0.0 stores passwords in plaintext in its configuration file, enabling an attacker with access to the file to obtain user passwords. This vulnerability is associated with CVE-2004-2708 and is corroborated by multiple sources in the connected documents (Red Hat, CV...

Design/Logic Flaw

The AXIS 207W camera stores a WEP or WPA key in cleartext in the configuration file, which might allow local users to obtain sensitive information...

CVE-2007-4928

The AXIS 207W camera stores a WEP or WPA key in cleartext in the configuration file, which might allow local users to obtain sensitive information...

VMware poor guest isolation design

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Summary VMware VIX API 1.1 supports an option that allows users with privileges on the host machine to execute programs on a guest operating system under the identity of a user currently logged into the guest. For example, if user A powers on a...

BIND: Weak random number generation

Background ISC BIND is the Internet Systems Consortium implementation of the Domain Name System DNS protocol. Description Amit Klein from Trusteer reported that the random number generator of ISC BIND leads, half the time, to predictable 1 chance to 8 query IDs in the resolver routine or in zone...

CVE-2007-4174

Tor before 0.1.2.16, when ControlPort is enabled, does not properly restrict commands to localhost port 9051, which allows remote attackers to modify the torrc configuration file, compromise anonymity, and have other unspecified impact via HTTP POST data containing commands without valid...

CVE-2007-4174

Tor before 0.1.2.16, when ControlPort is enabled, does not properly restrict commands to localhost port 9051, which allows remote attackers to modify the torrc configuration file, compromise anonymity, and have other unspecified impact via HTTP POST data containing commands without valid...

CVE-2007-4174

Tor before 0.1.2.16, when ControlPort is enabled, does not properly restrict commands to localhost port 9051, which allows remote attackers to modify the torrc configuration file, compromise anonymity, and have other unspecified impact via HTTP POST data containing commands without valid...

CVE-2007-4150

The Visionsoft Audit on Demand Service VSAOD in Visionsoft Audit 12.4.0.0 uses weak cryptography XOR when 1 transmitting passwords, which allows remote attackers to obtain sensitive information by sniffing the network; and 2 storing passwords in the configuration file, which allows local users to...

Design/Logic Flaw

The Visionsoft Audit on Demand Service VSAOD in Visionsoft Audit 12.4.0.0 uses weak cryptography XOR when 1 transmitting passwords, which allows remote attackers to obtain sensitive information by sniffing the network; and 2 storing passwords in the configuration file, which allows local users to...

CVE-2007-4150

The Visionsoft Audit on Demand Service VSAOD in Visionsoft Audit 12.4.0.0 uses weak cryptography XOR when 1 transmitting passwords, which allows remote attackers to obtain sensitive information by sniffing the network; and 2 storing passwords in the configuration file, which allows local users to...

CVE-2007-4150

The Visionsoft Audit on Demand Service VSAOD in Visionsoft Audit 12.4.0.0 uses weak cryptography XOR when 1 transmitting passwords, which allows remote attackers to obtain sensitive information by sniffing the network; and 2 storing passwords in the configuration file, which allows local users to...

CVE-2007-4150

The CVE-2007-4150 issue affects Visionsoft Audit 12.4.0.0 (Visionsoft Audit) where weak cryptography (XOR) is used for passwords: during transmission over the network (passwords can be sniffed) and in the configuration file (local read access can reveal passwords). No further exploit details are ...

GLSA-200707-10 : Festival: Privilege elevation

The remote host is affected by the vulnerability described in GLSA-200707-10 Festival: Privilege elevation Konstantine Shirow reported a vulnerability in default Gentoo configurations of Festival. The daemon is configured to run with root privileges and to listen on localhost, without requiring a...

Ripe Website Manager (CMS) <= 0.8.9 Remote File Inclusion Vulns

Exploit for unknown platform in category web applications =============================================================== Ripe Website Manager CMS Files: /admin/includes/authorpanelheader.php /admin/includes/adminheader.php - vulncode: Exploit:: http://www.site.com/path to...

security flaw

htsearch program in htDig 3.2 beta, 3.1.6, 3.1.5, and earlier allows remote attackers to determine the physical path of the server by requesting a non-existent configuration file using the config parameter, which generates an error message that includes the full path...