Design/Logic Flaw

The Control Panel in Parallels Plesk Panel 10.2.0 build 20110407.20 includes a submitted password within an HTTP response body, which allows remote attackers to obtain sensitive information by sniffing the network, as demonstrated by password handling in client@2/domain@1/odbc/dsn@1/properties/...

CVE-2011-4736

The CVE-2011-4736 issue affects Parallels Plesk Panel (Control Panel) version 10.2.0 build 20110407.20, where cleartext passwords are transmitted over HTTP in login_up.php3 and related files. Root cause: credentials sent unencrypted, enabling network sniffing. Impact is limited to exposed authent...

CVE-2011-4737

The Control Panel in Parallels Plesk Panel 10.2.0 build 20110407.20 includes a submitted password within an HTTP response body, which allows remote attackers to obtain sensitive information by sniffing the network, as demonstrated by password handling in client@2/domain@1/odbc/dsn@1/properties/...

CVE-2011-4758

Parallels Plesk Small Business Panel 10.2.0 receives cleartext password input over HTTP, which allows remote attackers to obtain sensitive information by sniffing the network, as demonstrated by forms in smb/auth and certain other files...

CVE-2011-4736

The Control Panel in Parallels Plesk Panel 10.2.0 build 20110407.20 receives cleartext password input over HTTP, which allows remote attackers to obtain sensitive information by sniffing the network, as demonstrated by forms in loginup.php3 and certain other files...

CVE-2011-4737

The CVE-2011-4737 entry affects Parallels Plesk Panel 10.2.0 build 20110407.20. The issue is that a submitted password is included in an HTTP response body (in a path involving client@2/domain@1/odbc/dsn@1/properties/), enabling remote attackers to obtain sensitive information by sniffing network...

CVE-2011-4848

The Control Panel in Parallels Plesk Panel 10.4.4build20111103.18 includes a submitted password within an HTTP response body, which allows remote attackers to obtain sensitive information by sniffing the network, as demonstrated by password handling in certain files under...

CVE-2011-1184

The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.12 does not have the expected countermeasures against replay attacks, which makes it easier for remote attackers to bypass intended access restrictions by sniffing the...

CVE-2011-1509

The encryptPassword function in Login.js in ManageEngine ServiceDesk Plus SDP 8012 and earlier uses a Caesar cipher for encryption of passwords in cookies, which makes it easier for remote attackers to obtain sensitive information by sniffing the network...

Design/Logic Flaw

The encryptPassword function in Login.js in ManageEngine ServiceDesk Plus SDP 8012 and earlier uses a Caesar cipher for encryption of passwords in cookies, which makes it easier for remote attackers to obtain sensitive information by sniffing the network...

CVE-2011-1509

Affected product : ManageEngine ServiceDesk Plus (SDP) versions up to 8.x, including SDP 8012 and earlier. Vulnerability details : CVE-2011-1509 is an authentication weakness where the encryptPassword function in Login.js uses a Caesar cipher with no salt or secret, storing passwords locally in c...

CVE-2011-1509

The encryptPassword function in Login.js in ManageEngine ServiceDesk Plus SDP 8012 and earlier uses a Caesar cipher for encryption of passwords in cookies, which makes it easier for remote attackers to obtain sensitive information by sniffing the network...

CVE-2011-2736

RSA enVision 4.x before 4 SP4 P3 places cleartext administrative credentials in Task Escalation e-mail messages, which allows remote attackers to obtain sensitive information by sniffing the network or leveraging access to a recipient mailbox...

Code injection

RSA enVision 4.x before 4 SP4 P3 places cleartext administrative credentials in Task Escalation e-mail messages, which allows remote attackers to obtain sensitive information by sniffing the network or leveraging access to a recipient mailbox...

CVE-2011-2736

RSA enVision 4.x before 4 SP4 P3 places cleartext administrative credentials in Task Escalation e-mail messages, which allows remote attackers to obtain sensitive information by sniffing the network or leveraging access to a recipient mailbox...

CVE-2011-2736

RSA enVision 4.x before 4 SP4 P3 is affected by CVE-2011-2736. Task Escalation emails may contain cleartext administrative credentials, allowing remote attackers to obtain sensitive information by sniffing the network or via access to a recipient mailbox. The related advisory ESA-2011-030 documen...

broadcast-listener NSE Script

Sniffs the network for incoming broadcast communication and attempts to decode the received packets. It supports protocols like CDP, HSRP, Spotify, DropBox, DHCP, ARP and a few more. See packetdecoders.lua for more information. The script attempts to sniff all ethernet based interfaces with an IP...

Default credentials

The Mobility Pack before 1.2 in Novell Data Synchronizer 1.x through 1.1.2 build 428 sends the Admin LDAP password in cleartext, which allows remote attackers to obtain sensitive information by sniffing the network...

CVE-2011-2223

CVE-2011-2223 affects Novell Data Synchronizer 1.x with Mobility Pack prior to 1.2 (Mobility Pack before 1.2 in Data Synchronizer 1.x through 1.1.2 build 428). The underlying issue is that the Admin LDAP password is transmitted in cleartext over the network, allowing remote attackers to sniff and...

CVE-2011-2223

The Mobility Pack before 1.2 in Novell Data Synchronizer 1.x through 1.1.2 build 428 sends the Admin LDAP password in cleartext, which allows remote attackers to obtain sensitive information by sniffing the network...