iDEFENSE Security Advisory 10.31.02c: PHP-Nuke SQL Injection Vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 iDEFENSE Security Advisory 10.31.02c: http://www.idefense.com/advisory/10.31.02c.txt PHP-Nuke SQL Injection Vulnerability October 31, 2002 I. BACKGROUND "PHP-Nuke is a news automated system specially designed to be used in Intranets and Internet. The...

CVE-2001-0502

The CVE-2001-0502 issue affects Windows 2000 LDAP over SSL where a function fails to properly verify permissions when the directory principal is a domain user and the data attribute is the domain password, allowing local users to modify other users’ login passwords. Affected component: LDAP over ...

CVE-2001-0502

Running Windows 2000 LDAP Server over SSL, a function does not properly check the permissions of a user request when the directory principal is a domain user and the data attribute is the domain password, which allows local users to modify the login password of other users...

CVE-2001-0502

Running Windows 2000 LDAP Server over SSL, a function does not properly check the permissions of a user request when the directory principal is a domain user and the data attribute is the domain password, which allows local users to modify the login password of other users...

MS01-011 / MS01-036: LDAP over SSL Arbitrary User Password Modification (287397 / 299687)

The remote version of Windows 2000 contains a bug in its LDAP implementation that fails to validate the permissions of a user requesting to change the password of a third-party user. An attacker may exploit this vulnerability to gain unauthorized access to the remote host. C Tenable Network...

CVE-2000-0944

CGI Script Center News Update 1.1 does not properly validate the original news administration password during a password change operation, which allows remote attackers to modify the password without knowing the original password...

CVE-2000-0117

On Cobalt RaQ2 servers, the siteUserMod.cgi CGI allows a Site Administrator to modify passwords for other users, including other Site Administrators and possibly the admin (root). This is a local vulnerability with high impact (confidentiality, integrity, availability) per CVSS 2.0 base score 7.2...

CVE-2000-0117

The siteUserMod.cgi program in Cobalt RaQ2 servers allows any Site Administrator to modify passwords for other users, site administrators, and possibly admin root...

CGI Script Center Subscribe Me Lite 2.0 - Administrative Password Alteration (2)

CGI Script Center Subscribe Me Lite 2.0 - Administrative Password Alteration 2 source: https://www.securityfocus.com/bid/1607/info Regardless of privilege level, any remote user can modify the administrative password for CGI Script Centers' Subscribe Me Lite. This would grant the user full...

CVE-2000-0045

MySQL allows local users to modify passwords for arbitrary MySQL users via the GRANT privilege...

raq2.admin.exploit.txt

To replicate this bug you must have Site Administrator access to one of the accounts on the server. When you go into the Site Management for a site and select the User Management option, you get a list of the usernames that have been setup for that account. The green pencil edit icon is a command...

Cobalt siteUserMod.cgi Arbitrary Password Modification

The Cobalt 'siteUserMod' CGI appears to be installed on the remote web server. Older versions of this CGI may allow a user with Site Administrator access to change the password of users on the system, such as Site Administrator or regular users, or the admin root user. Note that Nessus has only...

CVE-2000-0045

MySQL allows local users to modify passwords for arbitrary MySQL users via the GRANT privilege...