PFTP Cleartext Local Password Disclosure

The remote web server is running PFTP. This software stores the list of user names and passwords in clear text in \Program Files\PFTP\PFTPUSERS3.USR. An attacker with a full access to this host may use this flaw to gain access to other FTP servers used by the same users. C Tenable Network Securit...

BlackMoon FTP Server blackmoon.mdb Plaintext Password Disclosure

BlackMoon FTP server is installed on the remote host. FTP usernames and passwords are stored on the server in plaintext in a filed called 'blackmoon.mdb.' Any user with an account on this host may read the credentials stored in this file, and use them to connect to this FTP server. C Tenable...

CesarFTP settings.ini Authentication Credential Plaintext Disclosure

The remote host is running CesarFTP. Due to a design flaw in the program, the plaintext usernames and passwords of FTP users are stored in the file 'settings.ini'. Any user with an account on this host may read this file and use the password to connect to this FTP server. C Tenable Network...

Invision Power Board Plaintext Password Disclosure Vuln

Invision Power Board Plaintext Password Disclosure Vuln ------------------------------------------------------- Version: All? Problem: Invision Power Board gives an admin the option to create a pass protected forum. The problem with this is that the password is then stored in the cookie fully...

Super Guestbook superguestconfig Admin Password Disclosure

The remote server is running Super GuestBook, a set of php scripts to manage an interactive guestbook. An attacker may retrieve the file /superguestconfig, which contains the password of the guestbook administrator as well as other configuration details. %NASLMINLEVEL 70300 C Tenable Network...

GTcatalog password.inc Direct Request Password Disclosure

The remote web server hosts GTcatalog, a catalog management system written in PHP. It is possible to obtain the password of the remote GTcatalog installation by directly requesting the file 'password.inc'. An attacker may leverage this issue to obtain the password and gain administrative access t...

Adcycle build.cgi Remote Password Disclosure

The CGI 'build.cgi' is installed. This CGI has a well known security flaw that lets an attacker obtain the password of the remote AdCycle database or delete databases. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if description...

PHP-Nuke 5.6/6.x - 'banners.php' Banner Manager Password Disclosure

source: https://www.securityfocus.com/bid/7170/info It has been reported that an input validation error exists in the banners.php file included with PHPNuke. Because of this, an attacker could send a malicious string through PHPNuke that would allow the attacker to manipulate the database, and...

Guestbook tr3.a Password Disclosure

The remote install of Guestbook tr3.a fails to restrict access to its password file. An unauthenticated, remote attacker can leverage this issue to gain control of the affected application. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. Ref: Message-ID: From: subj To:...

HP JetDirect Printer - SNMP JetAdmin Device Password Disclosure

HP JetDirect J2552A/J2552B/J2591A/J3110A/J3111A/J3113A/J3263A/300.0 X Printer SNMP JetAdmin Device Password Disclosure Vulnerability source: https://www.securityfocus.com/bid/7001/info A problem with JetDirect printers could make it possible for a remote user to gain administrative access to the...

Cisco VPN 3000 Concentrator HTML Source Plaintext User Password Disclosure (CSCdv88230, CSCdw22408)

The remote VPN concentrator discloses the passwords of its users in the source HTML of the embedded web server. This vulnerability is documented as Cisco bug ID CSCdv88230 and CSCdw22408. C Tenable Network Security, Inc. Thanks to Nicolas FISCHBACH [email protected] for his help Ref:...

Cisco VPN 3000 Concentrator Certificate Management Page HTML Source Certificate Password Disclosure (CSCdw50657)

The remote VPN concentrator discloses the certificate passwords of its users in the source HTML pages of the embedded web server. This vulnerability is documented as Cisco bug ID CSCdw50657. C Tenable Network Security, Inc. Thanks to Nicolas FISCHBACH [email protected] for his help Ref:...

PHP-Board 1.0 - User Password Disclosure

source: https://www.securityfocus.com/bid/6862/info php-board user information is stored in flat files on the system hosting the software. Access to the files via the web is not sufficiently restricted. Remote attackers may request user files and gain access to php-board user and administrative...

PHP-Board 1.0 - User Password Disclosure

PHP-Board 1.0 - User Password Disclosure source: https://www.securityfocus.com/bid/6862/info php-board user information is stored in flat files on the system hosting the software. Access to the files via the web is not sufficiently restricted. Remote attackers may request user files and gain acce...

Buffer OverFlow in SQLBase 8.1.0 - NII Advisory

BUFFER OVERFLOW IN SQLBASE 8.1.0 =================================================== Advisory: Password Disclosure in Cryptainer Vendor: Gupta Technologies LLC http://www.guptaworldwide.com Versions affected: SQLBase 8.1.0 Date: 10th February 2003 Type of Vulnerability: Remotely Exploitable Buffe...

[BUGZILLA] Security Advisory - remote database password disclosure

Bugzilla Security Advisory January 2nd, 2002 Severity: major remote database password disclosure, bug 186383 minor local file permissions, bug 183188 Summary ======= All Bugzilla installations are advised to upgrade to the latest versions of Bugzilla, 2.14.5 and 2.16.2, both released today...

Password Disclosure in Cryptainer

=================================================== Advisory: Password Disclosure in Cryptainer Vendor: SecureSoft http://www.cypherix.com Download Location: http://www.cypherix.com/downloads.htm Versions affected: Cryptainer PE and Cryptainer 2.0 Date: 16th December 2002 Type of Vulnerability:...

Sun SunPCi II VNC Software 2.3 - Password Disclosure

// source: https://www.securityfocus.com/bid/5146/info The SunPCi II card is a co-processor for a number of Solaris based systems, and provides PC software compatibility, including the ability to run Microsoft Windows. Driver software is available for the SunPCi card, including a Virtual Network...

Sun SunPCi II VNC Software 2.3 - Password Disclosure

Sun SunPCi II VNC Software 2.3 - Password Disclosure // source: https://www.securityfocus.com/bid/5146/info The SunPCi II card is a co-processor for a number of Solaris based systems, and provides PC software compatibility, including the ability to run Microsoft Windows. Driver software is...

CVE-2001-1117: Undefined Security Weakness

LinkSys EtherFast BEFSR41 Cable/DSL routers running firmware before 1.39.3 Beta allows a remote attacker to view administration and user passwords by connecting to the router and viewing the HTML source for 1 index.htm and 2 Password.htm...