CVE-2000-1228

Phorum 3.0.7 allows remote attackers to change the administrator password without authentication via an HTTP request for admin.php3 that sets step, option, confirm and newPssword variables...

CVE-2000-0944

CGI Script Center News Update 1.1 does not properly validate the original news administration password during a password change operation, which allows remote attackers to modify the password without knowing the original password...

PT-2000-1856 · Cgi Script Center · Cgi Script Center News Update

Name of the Vulnerable Software and Affected Versions: CGI Script Center News Update version 1.1 Description: The issue concerns a problem with password validation during a password change operation. Specifically, it does not properly validate the original news administration password, allowing...

News Update 1.1 - Change Admin Password

News Update 1.1 - Change Admin Password / newsexp.c - description ------------------- begin : Sat Oct 21 2000 copyright : C 2000 by Morpheusbd email : [email protected] advisory : www.brightdarkness.de Exploit code for the News Update 1.1 by Morpheusbd For more information see my advisory which...

Дырка в CGI News Update

Поменять пароль можно не зная оригинального пароля...

CVE-2000-0689

Account Manager LITE does not properly authenticate attempts to change the administrator password, which allows remote attackers to gain privileges for the Account Manager by directly calling the amadmin.pl script with the setpasswd parameter...

Дырки в Subscribe Me/Account Manager

Непривелегированный пользователь может поменять пароль администратора...

Дырка в Blackboard Courseinfo

Непроверяемый ввод пользователя позволяет поменять пароль любого пользователя или создать нового...

CVE-2000-0045

CVE-2000-0045 affects MySQL: local users can modify passwords for arbitrary MySQL users via the GRANT privilege. The vulnerability is documented in CVE/NVD with a base score of 6.4 (MEDIUM). Connected documents confirm the issue but do not provide explicit affected versions or remediation details...

McMurtreyWhitaker Associates Cart32 2.63.0 - Remote Administration Password

McMurtreyWhitaker Associates Cart32 2.63.0 - Remote Administration Password source: https://www.securityfocus.com/bid/1153/info Within cart32.exe, entering any password by way of http://target/scripts/cart32.exe/cart32clientlist, a remote user could obtain vital client information such as usernam...

Pocsag POC32 Remote Service Default Password (password)

It is possible to log into the remote pocsag service and view the streams of decoded pager messages using the password 'password'. An attacker may use this problem to gain some knowledge about the computer user and then trick him by social engineering. C Tenable Network Security, Inc...

MySQL 3.22.273.22.293.23.8 - GRANT Global Password Changing

MySQL 3.22.273.22.293.23.8 - GRANT Global Password Changing source: https://www.securityfocus.com/bid/926/info MySQL is a popular RDBMS used by many websites as a back-end. It is possible for users with GRANT access to change passwords for every user in the database including the mysql superuser...

CVE-1999-0394

DPEC Online Courseware allows an attacker to change another user's password without knowing the original password...

Phorum 3.0.7 - 'admin.php3' Unverified Administrative Password Change

source: https://www.securityfocus.com/bid/2271/info Phorum is a popular, free, open source software package originally written by Brian Moon. The package is designed to add chat/bulletin board style interaction between visitors of a web site. A problem with Phorum can allow remote users access to...

anyboard.forum.passwd.txt

Date: Sat, 24 Apr 1999 03:55:39 +0200 From: "Bluefish @ home" To: [email protected] Subject: Anyboard www.netbula.com problem's publicly discussed in eurohack Draz Q published a short summary of problems with a webrelated software in eurohack. Basicly it sounds pretty much like a common CGI...

iis4.proxy.passwd.txt

Date: Mon, 9 Feb 1998 04:35:48 -0000 From: mnemonix To: [email protected] Subject: ALERT: IIS4 allows proxied password attacks over NetBIOS Introduction Internet Information Server 4.0 has an interesting feature that can allow a remote attacker to attack user accounts local to the Web Server a...

dpec-course-passwds.txt

Date: Fri, 15 Jan 1999 21:45:24 -0700 From: Joel Knight To: [email protected] Subject: DPEC Online Courseware DPEC's www.dpec.com Online Courseware has a nasty bug in it that allows anyone to change anyone elses password without knowing what their current password is. This is NOT limited to...

iusr_bug.txt

Internet User Bug Security Hole -kon. I've recently found a bug in NT 4 Server w/ IIS that allows the internet user IUSRCOMPUTER to change any user's password, including the administrators, leading to total server compromise. How it's done: The attacker must have access to the NT Server's web...

CVE-1999-0394

DPEC Online Courseware allows an attacker to change another user's password without knowing the original password...

PT-1999-1080 · Dpec · Dpec Online Courseware

Name of the Vulnerable Software and Affected Versions: DPEC Online Courseware affected versions not specified Description: The issue allows an attacker to change another user's password without knowing the original password. Recommendations: At the moment, there is no information about a newer...