2209 matches found
CVE-1999-1224
The vulnerability CVE-1999-1224 affects IMAP 4.1 BETA (and possibly other versions) where improper handling of the SIGABRT signal allows a local user to crash the imapd server, resulting in a core dump that may contain sensitive password information. This is a local-attack scenario with partial c...
CVE-1999-1224
IMAP 4.1 BETA, and possibly other versions, does not properly handle the SIGABRT abort signal, which allows local users to crash the server imapd via certain sequences of commands, which causes a core dump that may contain sensitive password information...
CVE-1999-1497
Ipswitch IMail 5.0 and 6.0 uses weak encryption to store passwords in registry keys, which allows local attackers to read passwords for e-mail accounts...
CVE-1999-1475
CVE-1999-1475 covers ProFTPd 1.2 compiled with the mod_sqlpw module, where passwords are recorded in the wtmp log file. This allows a local user to read passwords (e.g., via the last command) and potentially obtain privileges. Root cause: unintended password exposure via wtmp logging. Exploitatio...
RE: Possible Issue with Netinfo and Mac OS X
I have kept quiet about this to this point because I have not contacted Apple, or given the vendor any opportunity to respond, but if this discussion is going to be held in public, I think the following points are worthy of discussion: /usr/bin/nireport can be run by any user and can pull...
CVE-2001-1117
LinkSys EtherFast BEFSR41 Cable/DSL routers running firmware before 1.39.3 Beta allows a remote attacker to view administration and user passwords by connecting to the router and viewing the HTML source for 1 index.htm and 2 Password.htm...
Дырка в BrokerFTP (unauthorized directory browsing)
Команда ls и dele позволяет прочитать/удалить содержимое любого диска. Кроме того, пароли и разрешения хранятся в реестре в открытом виде. Большое количество других ошибок...
CVE-2001-0292
PHP-Nuke 4.4.1a allows remote attackers to modify a user's email address and obtain the password by guessing the user id UID and calling user.php with the saveuser operator...
iScouter PHP Web Portal System, MySQL Password in clear text
Hi all, I have found that i can easily retrieve MySQL password of the last iScouter PHP Web Portal System. Exploit : www.your-iScouter-web-portal.com/config.inc You can find those lines in clear text: $CFGDBSERVERTYPE = "mySQL"; $CFGDBHOST = "www.your-iScouter-web-portal.com"; $CFGDBUSERNAME =...
talkback.txt
whizkunde security advisory: talkback CGI http://www.whizkunde.org | [email protected] ---------------------------------------------------------- Release date: April 9th 2001 Subject: talkback.cgi security problem Systems affected: UNIX systems running talkback CGI script Vendor:...
PT-2001-1078 · Unix · Unix
Name of the Vulnerable Software and Affected Versions: Unix systems affected versions not specified Description: The issue allows users to perform a denial of service by locking out modems, dial out with that modem, or obtain passwords. This is related to the ptylogin component in Unix systems...
MySQL < 3.23.36 Multiple Vulnerabilities
The installed version of MySQL is older than version 3.23.36. Such versions are potentially affected by multiple vulnerabilities : - It is possible to modify arbitrary files and gain privileges by creating a database with '..' characters. CVE-2001-0407 - Users with a MySQL account can use the 'SH...
CVE-2001-0133
The web administration interface for Interscan VirusWall 3.6.x and earlier does not use encryption, which could allow remote attackers to obtain the administrator password to sniff the administrator password via the setpasswd.cgi program or other HTTP GET requests that contain base64 encoded...
CVE-2000-0957
The pluggable authentication module for mysql pammysql before 0.4.7 does not properly cleanse user input when constructing SQL statements, which allows attackers to obtain plaintext passwords or hashes...
CVE-2001-1275
MySQL before 3.23.31 allows users with a MySQL account to use the SHOW GRANTS command to obtain the encrypted administrator password from the mysql.user table and possibly gain privileges via password cracking...
Проблемы в mysql на Red Hat
некорректные разрешения на log-файл приводят к возможности их просмотра пользователем, в частности видна информация о паролях в открытом тексте...
mysqld log file
Tested on Red Hat 7.0: narrow@tornado /$ cat /var/log/mysqld.log | grep "Password=PASSWORD" 001225 21:08:18 7 Query UPDATE user SET Password=PASSWORD'rewt' WHERE user='root' narrow@tornado /$ Here we have the password for user 'root'. -- Narrow - [email protected] - http://www.zone.ee/unix/ - Esto...
CVE-2001-1464
Crystal Reports, when displaying data for a password protected database using HTML pages, embeds the username and password in cleartext in the HTML page and the URL, which allows remote attackers to obtain passwords...
CVE-2000-1161
The installation of AdCycle banner management system leaves the build.cgi program in a web-accessible directory, which allows remote attackers to execute the program and view passwords or delete databases...