Fedora Core 3 : kdelibs-3.3.1-2.4.FC3 (2004-550)

Tue Dec 14 2004 Than Ngo 3.3.1-2.4.FC3 - apply the patch to fix Konqueror Window Injection Vulnerability 142510 CVE-2004-1158, Thanks to KDE security team - Fri Dec 10 2004 Than Ngo 3.3.1-2.3.FC3 - Security Advisory: plain text password exposure, 142487 thanks to KDE security team Note that...

Fedora Core 2 : kdebase-3.2.2-8.FC2 (2004-549)

Tue Dec 14 2004 Than Ngo 3.2.2-8.FC2 - apply the patch to fix Konqueror Window Injection Vulnerability 142510 CVE-2004-1158, Thanks to KDE security team - Security Advisory: plain text password exposure, 142487 thanks to KDE security team - Tue Sep 28 2004 Than Ngo 6:3.2.2-7.FC2 - fix kdm...

Fedora Core 3 : kdebase-3.3.1-4.3.FC3 (2004-551)

Tue Dec 14 2004 Than Ngo 6:3.3.1-4.3.FC3 - apply the patch to fix Konqueror Window Injection Vulnerability 142510 CVE-2004-1158, Thanks to KDE security team - Fri Dec 10 2004 Than Ngo 6:3.3.1-4.2.FC3 - Security Advisory: plain text password exposure, thanks to KDE security team - the existing...

Fedora Core 2 : kdelibs-3.2.2-10.FC2 (2004-548)

Tue Dec 14 2004 Than Ngo 6:3.2.2-10.FC2 - apply the patch to fix Konqueror Window Injection Vulnerability 142510 CVE-2004-1158, Thanks to KDE security team - Security Advisory: plain text password exposure, 142487 thanks to KDE security team - Tue Sep 07 2004 Than Ngo 6:3.2.2-9.FC2 - add patch to...

Sharepoint 2003 installation fails and account password revealed in setup log

System tested/affected: WSS, SharePoint 2003 - Hebrew localized version Details: I have a domain user account which has a complex password, including a leading dash -. After installing SPS components which includes WSS, I was prompted to enter database access account, at which point I entered the...

[Full-Disclosure] Webroot Spy Sweeper Enterprise Adminpassord open to the world

Not sure if this list is the right place for this....... Spy Sweeper Enterprise from webroot http://www.webroot.com/products/spysweeper/enterprise/ leaves the admin password in plain site you can find it by going to HKEYLOCALMACHINESOFTWAREWebrootEnterpriseSpy Sweeperap This can be done from the...

3COM Wireless router (3CRADSL72) information disclosure

The router gives you a web page with user name, password, primary and secondary DNS, default gateway, etc, if you access http://routerIP/appsta.stm without athentification of any kind. Router details: Runtime Code Version 1.05 Jan 27 2004 14:58:25 Boot Code Version V1.3d Hardware Version 01A ADSL...

Debian DSA-338-1 : proftpd - SQL injection

runlevel [email protected] reported that ProFTPD's PostgreSQL authentication module is vulnerable to a SQL injection attack. This vulnerability could be exploited by a remote, unauthenticated attacker to execute arbitrary SQL statements, potentially exposing the passwords of other users, or t...

CVE-2001-1098

Cisco PIX firewall manager PFM 4.32g logs the enable password in plaintext in the pfm.log file, which could allow local users to obtain the password by reading the file...

WS_FTP Pro Client Weak Password Encrypted

The version of WSFTP client installed on the remote host uses a weak encryption method to store password information. A local attacker could exploit this to discover FTP passwords. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid14597; scriptversion"1.15";...

CVE-2004-0412

Mailman before 2.1.5 allows remote attackers to obtain user passwords via a crafted email request to the Mailman server...

CVE-2004-0706

Bugzilla 2.17.5 through 2.17.7 embeds the password in an image URL, which could allow local users to view the password in the web server log files...

CVE-2004-0706

Bugzilla 2.17.5 through 2.17.7 embeds the password in an image URL, which could allow local users to view the password in the web server log files...

CVE-2004-0652

BEA WebLogic Server and WebLogic Express 7.0 through 7.0 Service Pack 4, and 8.1 through 8.1 Service Pack 2, allows attackers to obtain the username and password for booting the server by directly accessing certain internal methods...

Mac OS X stores login/Keychain/FileVault passwords on disk

It seems that Mac OS X 10.3.4 tested doesn't bother clearing memory containing sensitive data, or using mlock to avoid swapping. A quick grep of the swapfiles will show up various morsels: rez: sudo strings -8 /var/vm/swapfile0 |grep -A 4 -i longname longname password user's password here /bin/zs...

ZWS Newsletter & Mailing List Manager

hello , i'm a frenchy boy and excuse me for my bad english... i decover a bug in the newsletter ZWS , http://www.target.com/newsletter/admin.php?f=listuser&uname=test&ulevel=1 with this , you can list all user register in the newsletter with respective password. after u log with a account Admin ,...

CVE-2004-0412

Removed by vendor...

PT-2004-1551

Name of the Vulnerable Software and Affected Versions Mailman versions prior to 2.1.5 Description The issue allows remote attackers to obtain user passwords by sending a crafted email request to the Mailman server. Recommendations For versions prior to 2.1.5, update to version 2.1.5 or later to...

BEA WebLogic Server stores database password in clear text in "config.xml"

Overview WebLogic Server contains a vulnerability that may expose the database username and password in clear text in the config.xml file. Description BEA Systems describes WebLogic Server as "an industrial-strength application infrastructure for developing, integrating, securing, and managing...

eCommerce Corporation Online Store Kit 3.0 - shop.php?cat SQL Injection

eCommerce Corporation Online Store Kit 3.0 - shop.php?cat SQL Injection source: https://www.securityfocus.com/bid/9687/info It has been reported that Online Store Kit is prone to multiple SQL injection vulnerabilities. These issues arise due to insufficient sanitation of user-supplied input via t...