CVE-1999-1393

Control Panel "Password Security" option for Apple Powerbooks allows attackers with physical access to the machine to bypass the security by booting it with an emergency startup disk and using a disk editor to modify the on/off toggle or password in the aaaaaaaAPWD file, which is normally...

CVE-1999-1073

Excite for Web Servers EWS 1.1 records the first two characters of a plaintext password in the beginning of the encrypted password, which makes it easier for an attacker to guess passwords via a brute force or dictionary attack...

CVE-1999-1078

The CVE applies to Ipswitch WS_FTP Pro (6.0) where passwords are stored with weak encryption in initialization files. This enables a remote attacker to decrypt stored passwords and potentially gain privileges. OpenVAS and Nessus entries corroborate weak stored password issues in WS_FTP Pro/Client...

CVE-2001-1005

Starfish Truesync Desktop 2.0b as used on the REX 5000 PDA uses weak encryption to store the user password in a registry key, which allows attackers who have access to the registry key to decrypt the password and gain privileges...

3Com Superstack 3 Switch Multiple Default Accounts

The 3Com Superstack 3 switch has the default passwords set. The attacker could use these default passwords to gain remote access to your switch and then reconfigure the switch. These passwords could also be potentially used to gain sensitive information about your network from the switch. This...

Starfish Truesync Desktop + REX 5000 Pro multiple vulnerabilities

Background: REX 5000 is a credit card sized PDA, made by Xircom which now is "An Intel Company". It is coming with a good PIM program, Starfish www.starfish.com Truesync Desktop which is probably a new rewrite of the well-known Starfish Sidekick. I just downloaded the last version, 2.0b. I notice...

Проблемы с паролем в SurgeFTP (bruteforceing, weak password).

пароль имеет слабое шифрование, кроме того не ограничено число попыток его ввода...

CVE-2001-0597

The CVE-2001-0597 entry concerns Zetetic Secure Tool for Recalling Important Passwords (STRIP) for PalmOS (0.5 and earlier). The vulnerability arises from STRIP using SysRandom seeded by TimeGetTicks, coupled with an implementation flaw that greatly reduces the password search space, enabling a l...

Network Solutions Crypt-PW Authentication-Scheme vulnerability

Problem: While crypt password authentication is not in and of itself very secure, Network Sulotions have made it even less so by including the first two characters of the password as the salt of the encrypted form. While the password is transmitted via a secure session, the encrypted form is...

CVE-2001-0415

The CVE-2001-0415 entry concerns the REDIPlus program (REDI.exe), which logs passwords and user names in cleartext to StartLog.txt. Root cause is cleartext credential logging, enabling local users to access other accounts. Reported impact affects confidentiality, integrity, and availability parti...

CVE-2001-0157

Palm OS 3.5.2 and earlier is affected by a debugging utility in the backdoor mode that lets an attacker with physical access bypass access restrictions and obtain passwords despite a lockout mechanism. The available sources do not specify a patch or remediation steps. Exploit specifics are not pr...

CVE-2001-0178

CVE-2001-0178 affects KDE2’s kdesu: the keep-password feature uses a UNIX socket to pass authentication data, but KDE2 (before 2.2.0-6) does not verify the socket listener’s identity. This can allow local users to obtain root passwords and gain privileges. Multiple advisories confirm the issue an...

Ultimate Bulletin Board

Here is a message I just popped off to infopop about their Ultimate Bulletin Board v5 product. It's not really meant for someone not used to their product. -------------------------------------------------------------------------------- If a user has info stored in a cookie, replies to a message...

CVE-1999-0359

ptylogin in Unix systems allows users to perform a denial of service by locking out modems, dial out with that modem, or obtain passwords...

CVE-2001-0103

CoffeeCup Direct and Free FTP clients uses weak encryption to store passwords in the FTPServers.ini file, which could allow attackers to easily decrypt the passwords...

mysqld log file

Tested on Red Hat 7.0: narrow@tornado /$ cat /var/log/mysqld.log | grep "Password=PASSWORD" 001225 21:08:18 7 Query UPDATE user SET Password=PASSWORD'rewt' WHERE user='root' narrow@tornado /$ Here we have the password for user 'root'. -- Narrow - [email protected] - http://www.zone.ee/unix/ - Esto...

Уязвимость локальной защиты в MDaemon

Локальную функцию блокировки программы паролем можно легко обойти...

Samba 2.0.7 SWAT vulnerabilities

the original writeup can be found at http://www.uberhax0r.net/miah/swat along with all the code mentioned in this advisory The program swat included in the samba distribution allows username and password bruteforcing. An attacker can easily generate userlists and then bruteforce their passwords...

CVE-2000-0754

Vulnerability in HP OpenView Network Node Manager NMM version 6.1 related to passwords...

CVE-2000-0164

Sun Internet Mail Server (SIMS) installations create a world-readable file that allows local users to obtain passwords. Affected: SIMS. Issue: world-writable or world-readable file exposure leading to complete confidentiality impact for local users. Root cause and exact file/path are not specifie...