CVE-2001-1275

MySQL before 3.23.31 allows users with a MySQL account to use the SHOW GRANTS command to obtain the encrypted administrator password from the mysql.user table and possibly gain privileges via password cracking...

mysqld log file

Tested on Red Hat 7.0: narrow@tornado /$ cat /var/log/mysqld.log | grep "Password=PASSWORD" 001225 21:08:18 7 Query UPDATE user SET Password=PASSWORD'rewt' WHERE user='root' narrow@tornado /$ Here we have the password for user 'root'. -- Narrow - [email protected] - http://www.zone.ee/unix/ - Esto...

Проблемы в mysql на Red Hat

некорректные разрешения на log-файл приводят к возможности их просмотра пользователем, в частности видна информация о паролях в открытом тексте...

CVE-2001-1464

Crystal Reports, when displaying data for a password protected database using HTML pages, embeds the username and password in cleartext in the HTML page and the URL, which allows remote attackers to obtain passwords...

CVE-2000-1161

The installation of AdCycle banner management system leaves the build.cgi program in a web-accessible directory, which allows remote attackers to execute the program and view passwords or delete databases...

CVE-2000-1158

NAI Sniffer Agent uses base64 encoding for authentication, which allows attackers to sniff the network and easily decrypt usernames and passwords...

Дырка в mailman

Ошибка форматной строки в wrapper позволяет получить привилегии группы mailman. Кроме того, файл содержащий пароли пользователей открыт на чтение...

Re: Новости 20 ноября 2000 г.

Проблемы с WinVNC Опубликовано: 20 ноября 2000 г. Источник: BUGTRAQ Тип: локальная Опасность: 5 Описание: Создаваемый ключ в реестре содержит пароли администрирования и позволяет редактирование пользователем. Продукты: WinVNC 3.3 Документы: Gossi The Dog, WinVNC 3.3.x,...

NetcPlus BrowseGate 2.80.2 - Weak Encryption

NetcPlus BrowseGate 2.80.2 - Weak Encryption / source: https://www.securityfocus.com/bid/1964/info BrowseGate is a proxy server which supports most standard protocols. A design error exists in BrowseGate which enables an authenticated user to view other users encrypted passwords. BrowseGate by...

NetcPlus BrowseGate 2.80.2 - Weak Encryption

/ source: https://www.securityfocus.com/bid/1964/info BrowseGate is a proxy server which supports most standard protocols. A design error exists in BrowseGate which enables an authenticated user to view other users encrypted passwords. BrowseGate by default intalls in the...

Samba 2.0.7 - SWAT Logfile Permissions

source: https://www.securityfocus.com/bid/1874/info The Samba software suite is a collection of programs that implements the SMB protocol for unix systems, allowing you to serve files and printers to Windows, NT, OS/2 and DOS clients. This protocol is sometimes also referred to as the LanManager ...

(SRADV00004) Remote and local vulnerabilities in pam_mysql

================================================= Secure Reality Pty Ltd. Security Advisory 4 SRADV00004 http://www.securereality.com.au ================================================= Title Remote and local vulnerabilities in pammysql Released 26/10/2000 Vulnerable All versions of pammysql 0.4...

CVE-2000-0707

CVE-2000-0707 affects PCCS MySQLDatabase Admin Tool Manager, versions 1.2.4 and earlier. The vulnerability stems from installing the file dbconnect.inc inside the web root, which permits remote attackers to read it and obtain sensitive credentials such as the database administrative password. Ope...

PCCS MySQL DB Admin Tool v1.2.3- Advisory

This advisory highlights a weakness in the file structure of the a href="http://PCCS-Linux.COM/PCCS"PCCS MySQL Database Admin Tool/a. This web application can expose a mySQL administrator’s password. Problem: The default install requires you to use a directory that is web accessible. Under that...

Дырка в PCCS MySQL DB Admin Tool

При установке по-умолчанию пароль администрирования находится в файле открытом для чтения и доступном через HTTP...

Roxen Web Server Vulnerability

Hi all, Excuse-me for my poor english : I discover two problems in Roxen Web server 2.0.46 and certainly prior. Perhaps it doesn't important. First problem: Suppose that Roxen is installed by default in /usr/local, the /usr/local/roxen/configurations/configinterface/settings/administratoruid file...

NT admin password change algorithms expose user plaintext passwords

eye-catching subject line, huh? well, under specific circumstances, unfortunately, it's true. as it's now early morning, i shall be reasonably brief. conditions required if using NTLMv1 LmCompatibilibyLevel=0: - NT admin runs USRMGR.EXE or SRVMGR.EXE and either adds a new user, workstation or...

Banner Rotation 01

-- Banner rotating 01 -- -- Description: "Banner rotating 01" is a cgi script distributed for free on several site builder sites, including Hot Area. The script is available on http://www.hotarea.net/web/scripts/banner01/ The cgi script offers numerous functions for those wishing to manage rotati...

Allmanage.pl Admin Password vulnerability

Allmanage.pl Admin Password vulnerability 15 may 2000 Another allmanage.pl vulnerability see also allmanage.pl.txt Everybody can easily get the admin password from the allmanage directory. You are able to set/change lots of variables, add accounts, mail users, backup, restore, edit header/footer...

Newssubmission: Security vulnerability in the ICS HTTPServer component

Hi, There's a security vulnerability in the Delphi Internet Component = Suite's HTTP server. http://www.rtfm.be/fpiette/indexuk.htm These components are widly spread. The vender has been notified of the = flaw. Vulnerability description: The vulnerability let's a person download any file on the...