CVE-2007-6192

The web management interface in Citrix NetScaler 8.0 build 47.8 uses weak encryption XOR of unpadded data to store credentials within a cookie, which makes it easier for remote attackers to obtain cleartext credentials when a cookie is captured via a known-plaintext attack...

CVE-2007-6192

The CVE-2007-6192 entry describes an information disclosure vulnerability in the Citrix NetScaler Web Management Interface (NetScaler 8.0 build 47.8). The issue arises from using weak encryption to protect cookie contents by XORing sensitive values (including credentials) with a fixed key stream,...

Citrix NetScaler Web Management Cookie Weakness

Citrix NetScaler Web Management Cookie Weakness Product: Citrix NetScaler http://www.citrix.com/lang/English/ps2/index.asp Background: For most web application logins a user fills out an HTTP form, which sets up the user with a session cookie. The cookie content is merely a session ID, which allo...

QQ website login RSA encrypted transmission defect analysis-vulnerability warning-the black bar safety net

! QQ Thanks to anonymous people posting QQ website login not using https is encrypted, instead of using the RSA asymmetric encryption to protect transmission of passwords and sensitive information security. QQ is in javascript to achieve the entire process. This idea is very novel, but is also...

VMWare Server Plaintext Authorization

Binary data 4288.prm...

Fedora 7 : proftpd-1.3.1-2.fc7 (2007-2613)

The Auth API in ProFTPD before 20070417, when multiple simultaneous authentication modules are configured, does not require that the module that checks authentication is the same as the module that retrieves authentication data, which might allow remote attackers to bypass authentication, as...

CVE-2002-2412

CVE-2002-2412 affects Winamp 2.80, where authentication credentials are stored in plaintext in the winamp.ini file (in the HTTP-AUTH and winamp sections). This plaintext storage enables local users to access other accounts on the same system. Documented sources from multiple feeds (NVD/Red Hat/CV...

CVE-2002-2412

Winamp 2.80 stores authentication credentials in plaintext in the 1 HTTP-AUTH and 2 winamp sections in winamp.ini, which allows local users to gain access to other accounts...

CVE-2002-2345

The CVE-2002-2345 entry concerns Oracle 9i Application Server 9.0.2, where the web cache administrator interface password is stored in plaintext. This credential leakage could allow remote attackers to access the administrator interface, implying unauthorized access to cached credentials. Public ...

contentcustom-disclose.txt

CONTENTCustomizer Trick: Hit Ctrl+Y on a page that ContentCustomizer controls and it brings you to the login screen ; Dork: inurl:"generator/default.php?doc=" Other fun stuff: dialog.php?action=del&doc='+pagename // Delete dialog.php?action=delbackup&doc='+pagename // Delete Backup...

CVE-2003-1476

Cerberus FTP Server 2.1 stores usernames and passwords in plaintext, which could allow local users to gain access...

CVE-2003-1476

CVE-2003-1476 affects Cerberus FTP Server 2.1. The provided documents describe a plaintext storage of usernames and passwords, which could allow local users to gain access. This disclosure aligns with a local-privilege concern but the connected sources do not provide explicit exploit vectors, imp...

CVE-2003-1482

The backup configuration file for Microsoft MN-500 wireless base station stores administrative passwords in plaintext, which allows local users to gain access...

CVE-2003-1482

CVE-2003-1482 affects the Microsoft MN-500 wireless base station. The issue is that the backup configuration file stores administrative passwords in plaintext, which enables local users to gain access. The available connected documents corroborate this exact description; no public details about a...

CVE-2003-1454

Affected software: Invision Board 1.0–1.1.1. Vulnerability: when a forum is password protected, the administrator password is stored in plaintext in a cookie, risking unauthorized access. Impact: potential remote access by attackers due to cookie exposure. Root cause: insecure handling of session...

CVE-2003-1437

BEA WebLogic Express and WebLogic Server 7.0 and 7.0.0.1, stores passwords in plaintext when a keystore is used to store a private key or trust certificate authorities, which allows local users to gain access...

CVE-2003-1439

Secure Internet Live Conferencing (SILC) 0.9.11 and 0.9.12 are affected, with passwords and sessions stored in plaintext in memory. The root cause is in-memory plaintext storage, enabling local users to obtain sensitive information. The available documents do not provide further details on affect...

CVE-2003-1437

BEA WebLogic Express and WebLogic Server 7.0 and 7.0.0.1 store passwords in plaintext when a keystore is used to store a private key or trust certificate authorities. This plaintext storage enables local users to gain access. The vulnerability affects the authentication/secret handling in the key...

CVE-2003-1439

Secure Internet Live Conferencing SILC 0.9.11 and 0.9.12 stores passwords and sessions in plaintext in memory, which could allow local users to obtain sensitive information...

CVE-2003-1401

login.php in php-Board 1.0 stores plaintext passwords in $username.txt with insufficient access control under the web document root, which allows remote attackers to obtain sensitive information via a direct request...