Microsoft Windows 9x / Me Share Level Password Bypass Vulnerability (2)

No description provided by source. source: http://www.securityfocus.com/bid/1780/info Share level password protection for the File and Print Sharing service in Windows 95/98/ME can be bypassed. Share level access provides peer to peer networking capabilities in the Windows 9x/ME environment. It...

SoftPerfect Bandwidth Manager 2.9.10 - Authentication Bypass

No description provided by source. Authentication Bypass and Password disclosure. SoftPerfect Bandwidth Manager Authentication Bypass Date: 22-June-2012 Author: Gitsnik http://dracyrys.com/softperfect Vendor Homepage: http://www.softperfect.com/ Software Link:...

Mac OS X Sudo Password Bypass

No description provided by source. This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit web site for more information on licensing and terms of use. http://metasploit.com/ require 'shellwords' class Metasploit3...

Disabling 'Find My iPhone' on iOS 7 without any Password

iOS devices have a feature called 'Find My iPhone', allows device owner to locate their stolen devices using linked Apple ID with iCloud Account. Unfortunately, a security flaw in iOS make it possible to turn off Find My iPhone without a password and enabled thieves to bypass the protection which...

5-year-old Boy discovers Microsoft Xbox Password Bypass vulnerability

A 5-year-old San Diego boy managed to hack one of the most popular gaming systems in the world, Xbox and has now been acknowledged as a security researcher by Microsoft. Kristoffer Von Hassel uncovered a vulnerability in Xbox Live's password system, that would allow someone to log into a Xbox...

Default credentials

mailpassword.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 allows remote authenticated users to bypass the prohibition on password changes via the forgotten password email functionality...

CVE-2014-2019

The iCloud subsystem in Apple iOS before 7.1 allows physically proximate attackers to bypass an intended password requirement, and turn off the Find My iPhone service or complete a Delete Account action and then associate this service with a different Apple ID account, by entering an arbitrary...

CVE-2011-1773

virt-v2v before 0.8.4 does not preserve the VNC console password when converting a guest, which allows local users to bypass the intended VNC authentication by connecting without a password...

Authentication flaw

virt-v2v before 0.8.4 does not preserve the VNC console password when converting a guest, which allows local users to bypass the intended VNC authentication by connecting without a password...

WBR-3406 Wireless Broadband NAT Router Web-Console - Password Change Bypass & CSRF Vulnerability

Exploit for hardware platform in category web applications ----------------------------------------------------------- WBR-3406 Wireless Broadband NAT Router Web-Console Password Change Bypass & CSRF Vulnerability This PoC code should do two main things: 1. Cross Site Request Forgery For more...

CVE-2013-5188

The CVE-2013-5188 entry concerns Apple macOS X before 10.9 where, when hibernation and autologin are enabled, the Screen Lock transition out of hibernation does not require a password. This enables physically proximate attackers to gain access by visiting an unattended workstation in a hibernatin...

Cisco Unity Connection Administrator Password Bypass (cisco-sa-20120229-cuc)

Cisco Unity Connection before 7.1.3bSu2 / 7.1.5 allows remote, authenticated users to change the administrative password by leveraging the Help Desk Administrator role, aka Bug ID CSCtd45141. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid70197; scriptversion"1.6";...

Mac OS X Sudo Password Bypass

This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit web site for more information on licensing and terms of use. http://metasploit.com/ require 'shellwords' class Metasploit3 'Mac OS X Sudo Password Bypass',...

JBoss: allows empty password to authenticate against LDAP

The default configuration of the 1 LdapLoginModule and 2 LdapExtLoginModule modules in JBoss Enterprise Application Platform EAP 4.3.0 CP10, 5.2.0, and 6.0.1, and Enterprise Web Platform EWP 5.2.0 allow remote attackers to bypass authentication via an empty password...

sudo protection bypass

It's possible to bypass password request by manipulating timestamps. Session id hijacking is possible under some conditions...

Mac OS X Sudo Password Bypass

This module gains a session with root permissions on versions of OS X with sudo binary vulnerable to CVE-2013-1775. Tested working on Mac OS 10.7-10.8.4, and possibly lower versions. If your session belongs to a user with Administrative Privileges the user is in the sudoers file and is in the...

Remote 0day Exploit for Tectia SSH Server released

Hacker @kingcope discovered critical vulnerability in Tectia SSH Server. Exploit working on SSH-2.0-6.1.9.95 SSH Tectia Server Latest available version from www.tectia.com that allow attacker to bypass Authentication remotely. Description : An attacker in the possession of a valid username of an...

MySQL Authentication Bypass Password Dump

This module exploits a password bypass vulnerability in MySQL in order to extract the usernames and encrypted password hashes from a MySQL server. These hashes are stored as loot for later cracking. Impacts MySQL versions: - 5.1.x before 5.1.63 - 5.5.x before 5.5.24 - 5.6.x before 5.6.6 And Maria...

sudo: does not ask for password on GID changes

check.c in sudo 1.7.x before 1.7.4p5, when a Runas group is configured, does not require a password for command execution that involves a gid change but no uid change, which allows local users to bypass an intended authentication requirement via the -g option to a sudo command...

正方教务管理系统web端成绩录入漏洞

简要描述： web端成绩录入可绕过密码验证录入成绩。 详细说明： web端在进行成绩录入时可以通过直接将动态页面从jscjmm.aspx修改为xfjscjlr.aspx进行绕过，只要具有教师的登录权限，不需要验证成绩录入密码即可直接进入成绩的录入和提交页面。 危害：成绩录入验证密码失效，意味着一旦教师密码被泄露因为很多教师用户的账户名和密码都为初始值没有进行修改，如改实例院校的教务系统有约30%的教师账户名和密码相同，任意用户可以在成绩录入有效期内于教师权限下的任意成绩修改与提交。 漏洞证明：...