4948 matches found
Scientific Linux Security Update : nss_ldap on SL5.x i386/x86_64
A race condition was discovered in nssldap which affected certain applications which make LDAP connections, such as Dovecot. This could cause nssldap to answer a request for information about one user with information about a different user. CVE-2007-5794 In addition, these updated packages fix t...
PYSEC-2012-34
OpenStack Keystone before 2012.1.1, as used in OpenStack Folsom before Folsom-1 and OpenStack Essex, does not properly implement token expiration, which allows remote authenticated users to bypass intended authorization restrictions by 1 creating new tokens through token chaining, 2 leveraging...
CVE-2012-2977
The management console in Symantec Web Gateway 5.0.x before 5.0.3.18 allows remote attackers to change arbitrary passwords via crafted input to an application script...
CVE-2012-2977
CVE-2012-2977 affects Symantec Web Gateway 5.0.x up to but not including 5.0.3.18. The vulnerability allows remote attackers to change arbitrary passwords via crafted input to an application script in the management console. Documented references include NVD entry and multiple third-party advisor...
Symantec Web Gateway Security Issues
SUMMARY Symantec's Web Gateway management console is susceptible to multiple security issues that include remote command execution, local file inclusion, arbitrary password change and SQL injection security issues. Successful exploitation could result in unauthorized command execution on or acces...
Multiple vulnerabilities in PBBoard
High-Tech Bridge Security Research Lab discovered multiple vulnerabilities in PBBoard, which can be exploited to perform SQL injection attacks, change password of arbitrary user and create arbitrary files in folder of the vulnerable application. 1 Multiple SQL Injections in PBBoard: CVE-2012-4034...
CVE-2011-4287
CVE-2011-4287 affects Moodle 2.0.x before 2.0.3 where admin/uploaduser_form.php does not force password changes for autosubscribed users. This allows remote attackers to gain access by using the initial password of a newly created autosubscribed account. The issue is documented across multiple so...
Passwords are Dead, Long Live Passwords
Passwords as a defensive measure are complete rubbish. There’s no two ways about that. The fact that high-value services such as online banking, corporate email and data storage use simple passwords as the only real security mechanism is a sad commentary on the state of defensive technologies. Bu...
RedHat Update for 389-ds-base RHSA-2012:0997-01
Check for the Version of 389-ds-base OpenVAS Vulnerability Test RedHat Update for 389-ds-base RHSA-2012:0997-01 Authors: System Generated Check Copyright: Copyright c 2012 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it und...
MetInfo 4.0 member/save.php 任意密码修改漏洞
No description provided by source...
rhds/389: plaintext password disclosure flaw
389 Directory Server before 1.2.11.6 aka Red Hat Directory Server before 8.2.10-3, after the password for a LDAP user has been changed and before the server has been reset, allows remote attackers to read the plaintext password via the unhasheduserpassword attribute...
ASPCMS 2.0 member/reg.asp Remote Pass Change
No description provided by source...
Huawei HG866 Authentication Bypass
Exploit for hardware platform in category web applications Exploit Title: Huawei HG866 Authentication Bypass Date: Jun 14 2012 Exploit Author: hkm Vendor Homepage: http://www.huawei.com Version: V1R2C01SPC202, R3.2.4.92sbn - R3.4.2.257sbn, 3FE53864AOCB16 Tested on: HG866GTAVER.C, 01, 02 Advisory:...
CVE-2012-1828
The administrative functions in AutoFORM PDM Archive before 7.1 do not have authorization requirements, which allows remote authenticated users to perform administrative actions by leveraging knowledge of a hidden function, as demonstrated by the password-change function...
CVE-2012-1828
AutoFORM PDM Archive/AutoFORM PDM Archive before 7.1 allows remote authenticated users to perform administrative actions due to missing authorization for hidden administrative functions (e.g., password-change). The issue is tied to the hidden function exposure and is addressed by vendor updates: ...
CVE-2012-2959
Cross-site request forgery CSRF vulnerability in password-manager/changePasswords.do in BMC Identity Management Suite 7.5.00.103 allows remote attackers to hijack the authentication of administrators for requests that change passwords...
BMC Identity Management Suite cross-site request forgery vulnerability
Overview BMC Identity Management Suite v7.5.00.103 and possibility other versions are vulnerable to cross-site request forgery vulnerabilities. Description CWE-352: Cross-Site Request Forgery CSRF:It has been reported that BMC Identity Management Suite v7.5.00.103 and possibility other versions a...
Design/Logic Flaw
d41d8cd98f00b204e9800998ecf8427e.php in the management web server on the Seagate BlackArmor device allows remote attackers to change the administrator password via unspecified vectors...
CVE-2012-2568
d41d8cd98f00b204e9800998ecf8427e.php in the management web server on the Seagate BlackArmor device allows remote attackers to change the administrator password via unspecified vectors...
CVE-2012-2568
The CVE-2012-2568 entry concerns the Seagate BlackArmor NAS management interface. The vulnerability stems from a static password reset PHP page (d41d8cd98f00b204e9800998ecf8427e.php) on the device’s management web server, which allows remote, unauthenticated attackers to reset the administrator p...