2140 matches found
PSWD.JS - Insecure Password Hash
/ source: https://www.securityfocus.com/bid/19333/info Applications running pswd.js are prone to an insecure password-hash weakness. This issue is due to a design flaw that results in password hashes being created in an insecure manner. This issue allows attackers to use precomputed password hash...
X7 Chat upgradev1.php old_prefix Parameter SQL Injection
The remote host is running X7 Chat, a web-based chat program written in PHP. The version of X7 Chat installed on the remote host fails to properly sanitize input to the 'oldprefix' parameter of the 'upgradev1.php' script before using it in a database query. This may allow an unauthenticated...
Loudblog index.php id Parameter SQL Injection
The remote host is running Loudblog, a PHP application for publishing podcasts and similar media files. The version of Loudblog installed on the remote host fails to sanitize input to the 'id' parameter of the 'index.php' script before using it in a database query. This may allow an unauthenticat...
CVE-2006-3398
The "change password forms" in Taskjitsu before 2.0.1 includes password hashes in hidden form fields, which allows remote attackers to obtain sensitive information from the 1 Category Editor and 2 User Information editor...
CVE-2006-3398
The CVE-2006-3398 entry involves Taskjitsu prior to 2.0.1, where password hashes are embedded in hidden fields of the change password forms. This allows remote attackers to obtain sensitive information from the Category Editor and the User Information editor. The issue is tied to versions before ...
CVE-2006-3398: Undefined Security Weakness
The "change password forms" in Taskjitsu before 2.0.1 includes password hashes in hidden form fields, which allows remote attackers to obtain sensitive information from the 1 Category Editor and 2 User Information editor...
PT-2006-4290 · Taskjitsu · Taskjitsu
Name of the Vulnerable Software and Affected Versions: Taskjitsu versions prior to 2.0.1 Description: The issue concerns the "change password forms" in Taskjitsu, where password hashes are included in hidden form fields. This allows remote attackers to obtain sensitive information from the Catego...
уязвимость в Sad Raven's guestbook
доброе время суток. Недавно я нашел уязвимость в Sad Raven's guestbook версии 1.1, которая позволяет любому пользователю получить доступ в админ-центр. Заранее прошу извинить, если эту уязвимость уже кто-то нашел, но я не нашел нигде о ней никакого упоминания. Все говорят только о том, что пароли...
confixx_exploit.pl.txt
sry - i know this isn't a cvs repository here - but the code posted yesterday was written after some 'b33r' an i made it looking a little less drunk this morning. bye defa ----BOF---- !/usr/bin/perl exploit for confixx professional = 3.1.2 the vulerability was discovered by: LoK Crew references:...
CVE-2006-1412
TFT Gallery 0.10 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the admin password file and obtain password hashes via a direct request to admin/passwd...
Improper access control
TFT Gallery 0.10 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the admin password file and obtain password hashes via a direct request to admin/passwd...
CVE-2006-1412
TFT Gallery 0.10 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the admin password file and obtain password hashes via a direct request to admin/passwd...
EUVD-2006-1416
TFT Gallery 0.10 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the admin password file and obtain password hashes via a direct request to admin/passwd...
Nodez <= 4.6.1.1 Mercury Multiple Remote Vulnerabilities
Exploit for unknown platform in category web applications ======================================================== Nodez = 4.6.1.1 Mercury Multiple Remote Vulnerabilities ======================================================== !/usr/bin/php -q -d shortopentag=on ? echo "Nodez 4.6.1.1 Mercury...
Nodez <= 4.6.1.1 Mercury Multiple Remote Vulnerabilities
No description provided by source. !/usr/bin/php -q -d shortopentag=on ? echo "Nodez 4.6.1.1 Mercury possibly prior versions multiple vulnerabilities\r\n"; echo "by rgod [email protected]\r\n"; echo "site: http://retrogod.altervista.org\r\n\r\n"; / software: site: nodez.greentinted.com/...
Improper access control
PHP Advanced Transfer Manager 1.00 through 1.30 stores sensitive information, including password hashes, under the web root with insufficient access control, which allows remote attackers to download each password hash via a direct request for a users/USERNAME file...
CVE-2006-1207
PHP Upload Center stores password hashes under the web root with insufficient access control, which allows remote attackers to download each password hash via a direct request for the upload/users/USERNAME file...
CVE-2006-1209
PHP Advanced Transfer Manager 1.00 through 1.30 stores sensitive information, including password hashes, under the web root with insufficient access control, which allows remote attackers to download each password hash via a direct request for a users/USERNAME file...
CVE-2006-1207
The CVE-2006-1207 issue affects PHP Upload Center. The vulnerability arises because password hashes are stored under the web root with insufficient access control, allowing remote attackers to download each password hash via a direct request to upload/users/[USERNAME]. The available documents des...
CVE-2006-1209
The CVE concerns PHP Advanced Transfer Manager (versions 1.00–1.30). The root cause is insufficient access control that stores sensitive data (including password hashes) under the web root. This enables remote attackers to retrieve password hashes by directly requesting a users/[USERNAME] file. C...