samba buffer overflow

Stack-based buffer overflow in nmbd in Samba 3.0.0 through 3.0.26a, when configured as a Primary or Backup Domain controller, allows remote attackers to have an unknown impact via crafted GETDC mailslot requests, related to handling of GETDC logon server requests...

samba -- multiple vulnerabilities

The Samba Team reports: Secunia Research reported a vulnerability that allows for the execution of arbitrary code in nmbd. This defect may only be exploited when the "wins support" parameter has been enabled in smb.conf. Samba developers have discovered what is believed to be a non-exploitable...

Linux initscripts weak permissions

Weak permissions for /var/log/btmp files cause information leak about unsuccessful logon attempt...

About the winlogon process stored in the current user's password problems-vulnerability warning-the black bar safety net

Look at this post before, I was wondering, why I used findpass of the time, sometimes you can find an administrator password, sometimes not? See this post later, slightly understand the point to ------------------------------ The following is from the focus of the post: Q: everyone knows you can...

SOL7923 - Cross-site scripting vulnerability in the logon page after enabling a pre-logon sequence - CVE-2007-6704

A cross-site scripting XSS vulnerability—CVE-2007-6704—exists in the FirePass logon page when a pre-logon sequence is enabled. The affected FirePass URL fails to fully sanitize URL input before the web page content is sent to the browser. It is possible for an attacker to create web pages,...

Cross site scripting

Cross-site scripting XSS vulnerability in the logon page in RSA EnVision 3.3.6 Build 0115 allows remote attackers to inject arbitrary web script or HTML via the username field...

CVE-2007-4900

Cross-site scripting XSS vulnerability in the logon page in RSA EnVision 3.3.6 Build 0115 allows remote attackers to inject arbitrary web script or HTML via the username field...

RSA EnVision Reflected XSS Hole

Application: RSA EnVision Vendor: http://www.rsa.com Version: Version 3.3.6 Build 0115 Bug: Cross-Site Scripting Risk: Medium Date: 12 Sept 2007 Author: Stelios Tigkas e-mail: Stigkas at Gmail dot com Current Employer: Fujitsu Services List: BugTraqSecurityFocus ======= Product ======= A Security...

Sql injection

Multiple SQL injection vulnerabilities in Cisco CallManager and Unified Communications Manager CUCM before 3.35sr2b, 4.1 before 4.13sr5, 4.2 before 4.23sr2, and 4.3 before 4.31sr1 allow remote attackers to execute arbitrary SQL commands via the lang variable to the 1 user or 2 admin logon page, a...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Cisco CallManager and Unified Communications Manager CUCM before 3.35sr2b, 4.1 before 4.13sr5, 4.2 before 4.23sr2, and 4.3 before 4.31sr1 allow remote attackers to inject arbitrary web script or HTML via the lang variable to the 1 user or 2 adm...

CVE-2007-4633

Multiple cross-site scripting XSS vulnerabilities in Cisco CallManager and Unified Communications Manager CUCM before 3.35sr2b, 4.1 before 4.13sr5, 4.2 before 4.23sr2, and 4.3 before 4.31sr1 allow remote attackers to inject arbitrary web script or HTML via the lang variable to the 1 user or 2 adm...

CVE-2007-4634

Multiple SQL injection vulnerabilities in Cisco CallManager and Unified Communications Manager CUCM before 3.35sr2b, 4.1 before 4.13sr5, 4.2 before 4.23sr2, and 4.3 before 4.31sr1 allow remote attackers to execute arbitrary SQL commands via the lang variable to the 1 user or 2 admin logon page, a...

XSS and SQL Injection in Cisco CallManager/Unified Communications Manager Logon Page

THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. CISCO RESERVES TH...

Code injection

Cisco VPN Client on Windows before 4.8.02.0010 allows local users to gain privileges by enabling the "Start Before Logon" SBL and Microsoft Dial-Up Networking options, and then interacting with the dial-up networking dialog box...

CVE-2007-4414

Cisco VPN Client on Windows before 4.8.02.0010 allows local users to gain privileges by enabling the "Start Before Logon" SBL and Microsoft Dial-Up Networking options, and then interacting with the dial-up networking dialog box...

Cisco VPN client privilege escalation

Weak files permissions, code execution before logon with "Allow launching of third party applications before logon" and dialup networking...

Cisco Trust Agent for Mac OS X privilege escalation

It's possible to manipulate system settings with root permissions while message is displayed during user logon...

Multiple Symantec antiviral products Reporting Server code execution

It's possible to spoof executable report file. Password hash is leaked during failed logon attempt...

Microsoft Windows Active Directory users account enumeration

It's possible to enumerate accounts with Logon Hours limitation set...

[Full-disclosure] Microsoft Windows Active Directory Logon Hours User Enumeration Weakness

Windows Server 2003 can be configured http://support.microsoft.com/kb/816666 to restrict the hours and days that a user may log on to a Windows Server 2003 domain. This could lead to username enumeration. Issue:- Microsoft Windows Active Directory Username Enumeration Criticality:- Less Critical...