Novell Client for Windows口令重置本地栈溢出漏洞

BUGTRAQ ID: 29109 CVECAN ID: CVE-2007-5762 Novell Client是允许NetWare连接到Windows的工作站软件。 Novell Client在处理用户名字段时存在栈溢出漏洞，如果用户在登录时提交了超长的用户名就可以触发这个溢出。 目前这个漏洞已经修复，将用户名字段限制为255个字符。但如果在登录时点击了“忘记口令”链接的话，就会弹出一个包含有所提供的用户名的窗口，这仍可触发栈溢出，导致蓝屏死机。 Novell Client http://support.novell.com/security-alerts...

[Full-disclosure] Oracle - Hardcoded Password and Password Reset of OUTLN User [DB13]

Oracle - Hardcoded Password and Password Reset of OUTLN User DB13 Systems Affected 9i Rel. 1 - 10g Rel. 2 Severity High Risk Category Hardcoded Default Password & Password Reset Vendor URL http://www.oracle.com/ Author Alexander Kornbrust Advisory 16 April 2008 V 1.00 Advisory URL...

Design/Logic Flaw

The password reset feature in PunBB 1.2.16 and earlier uses predictable random numbers based on the system time, which allows remote authenticated users to determine the new password via a brute force attack on a seed that is based on the approximate creation time of the targeted account. NOTE:...

CVE-2008-1484

The password reset feature in PunBB 1.2.16 and earlier uses predictable random numbers based on the system time, which allows remote authenticated users to determine the new password via a brute force attack on a seed that is based on the approximate creation time of the targeted account. NOTE:...

CVE-2008-1484

The password reset feature in PunBB 1.2.16 and earlier uses predictable random numbers based on the system time, which allows remote authenticated users to determine the new password via a brute force attack on a seed that is based on the approximate creation time of the targeted account. NOTE:...

CVE-2008-1484

PunBB 1.2.16 and earlier has a vulnerability in the password reset mechanism where the seed for the reset token is derived from the system time, enabling remote authenticated users to brute-force and determine a new password. The issue affects PunBB’s password reset function and can be exploited ...

Advisory SE-2008-01: PunBB Blind Password Recovery Vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 SektionEins GmbH www.sektioneins.de -= Security Advisory =- Advisory: PunBB Blind Password Recovery Vulnerability Release Date: 2008/02/20 Last Modified: 2008/02/20 Author: Stefan Esser stefan.esseratsektioneins.de Application: PunBB = 1.2.16 Severity...

PunBB < 1.2.17 Password Reset Information Disclosure

Binary data 4391.prm...

Debian Security Advisory DSA 271-1 (ecartis, listar)

The remote host is missing an update to ecartis, listar announced via advisory DSA 271-1. OpenVAS Vulnerability Test $Id: deb2711.nasl 6616 2017-07-07 12:10:49Z cfischer $ Description: Auto-generated from advisory DSA 271-1 Authors: Thomas Reinke Copyright: Copyright c 2007 E-Soft Inc...

CVE-2007-6237

cp.php in DeluxeBB 1.09 fails to verify that the membercookie matches the authenticated member during profile updates, enabling remote authenticated users to change e-mails for arbitrary accounts via a modified membercookie parameter (a different vector than CVE-2006-4078). This can be leveraged ...

"Forgot password" function allows easy misuse

The "Forgot password" function invents a new password and sends it by email. This invites to misuse as guessing the userid already allows to annoy or even lock-out the legitimate account owner. The user may currently not have access to his email account or the mail could be killed by a spam filte...

Design/Logic Flaw

login.php in Pligg CMS 9.5 uses a guessable confirmation code when resetting a forgotten password, which allows remote attackers with knowledge of a username to reset that user's password by calculating the confirmationcode parameter...

CVE-2007-5579

login.php in Pligg CMS 9.5 uses a guessable confirmation code when resetting a forgotten password, which allows remote attackers with knowledge of a username to reset that user's password by calculating the confirmationcode parameter...

The history of the most simple Windows System Password rescue-vulnerability warning-the black bar safety net

Forgot Windows login password? On the Internet about solution are numerous, but after trying you will find that many methods are simply not effective, and some may even cause the system to collapse completely. By the author in Windows 2 0 0 0 and Windows XP in the repeated research and testing,...

CVE-2007-3796

The password reset feature in the Spam Quarantine HTTP interface for MailMarshal SMTP 6.2.0.x before 6.2.1 allows remote attackers to modify arbitrary account information via a UserId variable with a large amount of trailing whitespace followed by a malicious value, which triggers SQL buffer...

Sql injection

The password reset feature in the Spam Quarantine HTTP interface for MailMarshal SMTP 6.2.0.x before 6.2.1 allows remote attackers to modify arbitrary account information via a UserId variable with a large amount of trailing whitespace followed by a malicious value, which triggers SQL buffer...

CVE-2007-3796

The password reset feature in the Spam Quarantine HTTP interface for MailMarshal SMTP 6.2.0.x before 6.2.1 allows remote attackers to modify arbitrary account information via a UserId variable with a large amount of trailing whitespace followed by a malicious value, which triggers SQL buffer...

CVE-2007-3796

CVE-2007-3796 affects MailMarshal SMTP’s Spam Quarantine HTTP interface. The vulnerability stems from the password reset feature, where a UserId value with excessive trailing whitespace followed by a malicious value can trigger SQL buffer truncation due to length inconsistencies, potentially allo...

PT-2007-5034 · Marshalsec · Mailmarshal Smtp

Name of the Vulnerable Software and Affected Versions: MailMarshal SMTP versions 6.2.0.x through 6.2.0.x Description: The password reset feature in the Spam Quarantine HTTP interface has an issue that allows remote attackers to modify arbitrary account information. This is achieved by exploiting...

pligg-password.txt

Pligg critical vulnerability Concerned version : 9.5 and ? Description : Pligg is a flexible CMS based on PHP and MYSQL. To reinitialize a forgotten password, Pligg follows a classical process. A confirmation code is generated and sent by email to the concerned user mail box. The user has to foll...