NetCharts Server Default Password

The remote host is running the NetCharts server on this port, with the default login and password of 'Admin/Admin'. An attacker may use this misconfiguration to control the remote server. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; i...

Entrust Authority Security Manager (EASM) does not enforce multiple authorization requirement for master user password change

Overview Entrust Authority Security Manager contains a vulnerability that could allow a master user to change the password of another master user. A master user could exploit this vulnerability to perform operations that otherwise require authorization by multiple master users. Description Entrus...

[SECURITY] [DSA 271-1] New ecartis and listar packages fix password change vulnerability

-------------------------------------------------------------------------- Debian Security Advisory DSA 271-1 [email protected] http://www.debian.org/security/ Martin Schulze March 27th, 2003 http://www.debian.org/security/faq -...

[SECURITY] [DSA 271-1] New ecartis and listar packages fix password change vulnerability

-------------------------------------------------------------------------- Debian Security Advisory DSA 271-1 [email protected] http://www.debian.org/security/ Martin Schulze March 27th, 2003 http://www.debian.org/security/faq -...

Ecardis Password Reseting Vulnerability

Hi, I don't know if someone has discovered this before but Ecartis 1.0.0 former listar contains a vulnerability that enables an attacker to reset passwords of any user defined on the list server, including the list admins. After logging on as a non-priviledged user, Ecartis enables the user to...

Default Password (root) for 'root' Account

The account 'root' on the remote host has the password 'root'. An attacker may leverage this issue to gain total control of the affected system. Note that, while SKIDATA Freemotion.Gate controllers are known to use these credentials, this plugin reports any time it finds a host using these...

Default Password (wh00t!) for 'root' Account

The account 'root' has the password 'wh00t!'. An attacker may use this to gain further privileges on this system. This account suggests that the Wh00t Rootkit may be present on the system. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. account = "root"; password = "wh00t!";...

CVE-2002-1846

Yet Another Bulletin Board YaBB 1.40 and 1.41 does not require a user to submit the correct password before changing it to a new password, which allows remote attackers to modify passwords by stealing the cookie of another user, modifying the expiretime setting, and submitting the change in a...

SAMBA buffer overflow

Buffer overflow on password change...

Have JIRA delete cookie when user authentication fails

I would like to suggest that if JIRA loads the user details id and password from a cookie and attempts to authenticate and fails then JIRA should delete the cookie. The logic behind this is: We are using LDAP for authentication to Novell's NDS and if a user gets JIRA to remember their id and...

WS_FTP Server SITE CPWD Command Remote Overflow

This host is running a version of WSFTP FTP server prior to 3.1.2. Versions earlier than 3.1.2 contain an unchecked buffer in routines that handle the 'CPWD' command arguments. The 'CPWD' command allows remote users to change their password. By issuing a malformed argument to the CPWD command, a...

CVE-2002-0421

IIS 4.0 allows local users to bypass the "User cannot change password" policy for Windows NT by directly calling .htr password changing programs in the /iisadmpwd directory, including 1 aexp2.htr, 2 aexp2b.htr, 3 aexp3.htr , or 4 aexp4.htr...

CVE-2002-0776

getuserdesc.asp in Hosting Controller 2002 allows remote attackers to change the passwords of arbitrary users and gain privileges by modifying the username parameter, as addressed by the "UpdateUser" hot fix...

Hosting Controller Vulnerability

In Hosting Controller 2002, it is possible to change the password of any user, Administrator. To exploit this, one would have to: Add a user /accounts/getuserdesc.asp Edit the user, changing the password /accounts/updateuserdesc.asp Then using something like the @stake web proxy, change the hidde...

CVE-2001-0981

CVE-2001-0981 affects HP CIFS/9000 Server (SAMBA) versions A.01.07 and earlier. With the 'unix password sync' option enabled, the server calls passwd without the requesting username, which could cause the password of a different user to be changed. Impact: potential unauthorized password changes....

CVE-2002-0589

PVote before 1.9 allows remote attackers to change the administrative password and gain privileges by directly calling chinfo.php with the newpass and confirm parameters both set to the new password...

PVote 1.0/1.5 - Unauthorized Administrative Password Change

source: https://www.securityfocus.com/bid/4541/info PVote is a web voting system written in PHP. It will run on most Unix and Linux variants as well as Microsoft Windows operating systems. It is possible to change the administrative password by submitting a malicious web request containing the...

[[ TH 026 Inc. ]] SA #1 - Multiple vulnerabilities in PVote 1.5

Telhack Security Advisory - 1 Name: PVote 1.5b Impact: Minor Content manipulation, Script admin Date: April 18 / 2002 Daniel Nystrm [email protected] I N F O PVote is a PHP voting system. It uses MySQL to hold all information about the system. Author has been notified of all three problems...

[SA-2002:00] Slashcode login vulunerability

SA-2002:00 Slashcode login vulunerability RISK FACTOR: HIGH SYNOPSIS Slash, the code that runs Slashdot and many other web sites, has a vulnerability in recent versions that allows any logged-in user to log in as any other user. This allows users to take nearly full control of a Slash system post...

CVE-2001-0981

HP CIFS/9000 Server SAMBA A.01.07 and earlier with the "unix password sync" option enabled calls the passwd program without specifying the username of the user making the request, which could cause the server to change the password of a different user...