Lotus Notes does not adequately secure databases thereby permitting arbitrary user to extract file attachments via NSFDbReadObject function call

Overview Lotus Domino Servers 5.x, 4.6x, and 4.5x allow users to associate objects with documents in a database. While these objects appear to be a part of the document, they are actually stored as separate files. A vulnerability exist by which an intruder could view these objects regardless of t...

Oracle 9iAS default configuration uses well-known default passwords

Overview Oracle Database Server version 9iAS installs with up to 160 distinct default login accounts. The usernames and passwords for these have been made publicly available and could be used by an attacker to gain access to an Oracle server. Description Depending on the components chosen at...

DoS против административного доступа в Lotus Domino

Можно заблокировать базу данных запросом типа http://server/./webadmin.nsf...

phpBB 1.4.2, Remote user is able to modify SQL query.

Hi, there is a a potential security problem in the current version 1.4.2 and previous versions of phpBB http://www.phpbb.com. A remote user is able to modify a string passed as a SQL query to the MySQL database. The problem exists in the file bbmemberlist.php. A string called $sortby is supplied...

vulnerability in oracle binary in Oracle 8.0.5 - 8.1.6

WWW.PLAZASITE.COM System & Security Division Title: Vulnerability in oracle binary in Oracle 8.0.5 Date: 11-12-2000 Platform: Only tested in Linux, but can be "exported" to others. Impact: Any user compromise any file owned by oracle DDBB owner. Author: Juan Manuel Pascual [email protected]...

TWIG SQL query bugs

I can't find the person who really in charge on developing twig, so I mail about this bug to the person who announce new version of twig about two month ago. -------------------------------------------------------------------------- Subject: Unquoted SQL query = potential damage Software package:...

Microsoft SQL Server sa Account Default Blank Password

The remote instance of MS SQL / SQL Server has the default 'sa' account enabled without any password. An attacker may leverage this flaw to execute commands against the remote host, as well as read the content of any databases it might have. %NASLMINLEVEL 70300 this script attempts to log in to a...

IBM DB2 default account and password Vulnerability

1.Description The DB2 Universal Database builds upon the stability and performance of DB2 on the mainframe and provides the features required in a distributed database product. DB2 Universal Database UDB is IBM's relational database server solution for the UNIX, OS/2 and Windows NT/2000 operating...

PCCS MySQL DB Admin Tool v1.2.3- Advisory

This advisory highlights a weakness in the file structure of the a href="http://PCCS-Linux.COM/PCCS"PCCS MySQL Database Admin Tool/a. This web application can expose a mySQL administrator’s password. Problem: The default install requires you to use a directory that is web accessible. Under that...

Security Bulletin (MS00-041)

Microsoft Security Bulletin MS00-041 - -------------------------------------- Patch Available for "DTS Password" Vulnerability Originally posted: June 14, 2000 Summary ======= Microsoft has released a patch that eliminates a security vulnerability in a component that ships with Microsoftr SQL...

CVE-2000-0385

FileMaker Pro 5 Web Companion allows remote attackers to bypass Field-Level database security restrictions via the XML publishing or email capabilities...

CVE-2000-0449

Omnis Studio 2.4 uses weak encryption trivial encoding for encrypting database fields...

PostgreSQL 6.3.26.5.3 - Cleartext Passwords

PostgreSQL 6.3.26.5.3 - Cleartext Passwords source: https://www.securityfocus.com/bid/1139/info PostgreSQL is a free RDBMS that is released under a Berkeley style license. PostgreSQL stores passwords for database users in a binary file called pgshadow. This file is readable by root and the postgr...

CVE-2000-0148

CVE-2000-0148 : MySQL 3.22 allows remote attackers to bypass password authentication and read a database by exploiting a short check string. The vulnerability is triggered remotely over the network with low attack complexity and results in partial confidentiality and integrity impact (and partial...

CVE-1999-0364

CVE-1999-0364 affects Microsoft Access 97, where a database password is stored as plaintext in a foreign .mdb file, enabling access to data. The linked documents consistently describe plaintext password storage as the vulnerability; no patch or remediation details are provided in the sources. Imp...

unixware.rtpm.txt

Greetings, OVERVIEW Any local users can exploit a bug in rtpm to gain "sys" privileges. A root compromise is then trivial. BACKGROUND As usual, I've only tested UnixWare 7.1, all others should be assumed vulnerable. UnixWare has a slightly different system of managing the password database than...

ms-access-97-passwords.txt

Date: Thu, 4 Feb 1999 04:15:13 -0700 From: "Donald Moore MindRape" To: [email protected] Subject: Microsoft Access 97 Stores Database Password as Plaintext ====================================================================== Title: Microsoft Access 97 Stores Database Password as Plaintext...

jdedwards.app.passwd.txt

Date: Mon, 3 May 1999 15:09:11 -0400 From: "Stout, Bill" To: [email protected] Subject: JDEdwards application passwords Anyone have experience with JDEdwards applicationsWorldVision/OneWorld? The user JDE password JDE is written into multiple places in config files, and is typically installed...

mSQL.remote.txt

Date: Mon, 15 Feb 1999 04:56:24 -0500 From: Dave G. To: [email protected] Subject: KSRT Advisory 10: mSQL ServerStats KSRT Security Advisories http://www.ksrt.org [email protected] --- KSRT Advisory 010 Date: Feb. 15, 1999 ID : msql-info-010 Affected Program: mSQL Mini SQL 2.0.6 and below Operatin...