ikiwiki -- cleartext passwords

The ikiwiki development team reports: Until version 2.48, ikiwiki stored passwords in cleartext in the userdb. That risks exposing all users' passwords if the file is somehow exposed. To pre-emtively guard against that, current versions of ikiwiki store password hashes using Eksblowfish...

CVE-2008-1971

CVE-2008-1971 affects phShoutBox Final 1.5 and earlier. The vulnerability arises because authentication checks are performed only when a password is provided in $_POST, enabling remote attackers to elevate privileges by setting the phadmin cookie to admin.php (and, in 1.4 and earlier, the ssbadmi...

Design/Logic Flaw

WebCore, as used in Apple Safari before 3.1, does not properly mask the password field when reverse conversion is used with the Kotoeri input method, which allows physically proximate attackers to read the password...

Mozilla Foundation Security Advisory 2008-04

Mozilla Foundation Security Advisory 2008-04 Title: Stored password corruption Impact: Moderate Announced: February 7, 2008 Reporter: Justin Dolske Products: Firefox Fixed in: Firefox 2.0.0.12 Description Mozilla developer Justin Dolske discovered that malicious sites, upon a user saving his or h...

Husrev Forums v2.0.1:PoWerBoard (tr) (id) Remote SQL Injection

---------------------------------------------------- Bulan: Cr@zyKing Thanks : CrackersChild & Eno7 & Pablin77 & Sys7ech & Brond Crew & X-Tech .Inc & TheBekir AYYILDIZ SWAT TIM : Hoo0? Google Dork : "Powered By Husrev" ---------------------------------------------------- Exploit:...

Privileg escalation in Omegasoft Insel 7

Hi list, Omegasoft's Insel 7 stores Cookies on your computer for identifying the logged-in user. As these Cookies do not contain any password hash but only the username and some meaningless stuff you can easily get into the system with another login. this gets even more easy, as there is a...

DEBIAN-CVE-2007-6598

Dovecot before 1.0.10, with certain configuration options including use of %variables, does not properly maintain the LDAP+auth cache, which might allow remote authenticated users to login as a different user who has the same password...

Design/Logic Flaw

The Globe7 soft phone client 7.3 uses weak cryptography reversed sequence of binary values for the password, which might allow local users to obtain sensitive information...

CVE-2002-2326

The CVE concerns Mail.app in macOS X 10.0–10.0.4 and 10.1–10.1.5, where iDisk credentials are sent in cleartext when connecting to Mac.com. The root cause is the default Mail.app configuration allowing unencrypted authentication, enabling an attacker on the network to sniff passwords. The provide...

CVE-2003-1483

CVE-2003-1483 affects FlashFXP 1.4, where the password storage uses a weak encryption algorithm. The underlying issue is insecure password handling, enabling attackers to decrypt stored passwords and gain access. Public details consistently report this weakness without specifying exploitation sta...

CVE-2007-5576

BEA Tuxedo 8.0 prior to RP392 and 8.1 prior to RP293, and WebLogic Enterprise 5.1 prior to RP174, disclose passwords in cleartext via local commands (cnsbind, cnsunbind, cnsls), enabling physically proximate attackers to obtain sensitive information. Affected components: password handling in the ...

openSUSE 10 Security Update : samba (samba-1830)

Prevent potential crash in winbindd's credential cache handling; 184450. - Fix memory exhaustion DoS; CVE-2006-3403; 190468. - Fix the munlock call, samba.org svn rev r16755 from Volker. - Change the kerberos principal for LDAP authentication to netbios-name$@realm from host/name@realm; 184450. -...

DTSA-60-1 kdebase - kdm allows user logins without a password in some configurations

Bulletin has no description...

Hidden administrator account the three minutes to get-vulnerability warning-the black bar safety net

On the regedit. exe everyone is familiar with, but not to the registry key set permissions, regedt32. exe the biggest advantages is the ability to the registry key set permissions. nt/2 0 0 0/xp account information in the registry HKEYLOCALMACHINE\SAM\SAM key, but in addition to the system user...

Security Master weapon awareness of Rainbow hash table crack tool-vulnerability warning-the black bar safety net

Cross-platform password Cracker Ophcrack the crack speed is simply incredible. In the end how fast? It can be in 1 6 0 seconds to crack“Fgpyyih804423”this password. Many people think that this password is already quite safe. Microsoft's password strength determination tool that the password of th...

For grasping the win2003 system password trick-vulnerability warning-the black bar safety net

The command line to uninstall the win2003 sp1/sp2 %systemroot%$NtServicePackUninstall$\spuninst\spuninst /U Press the unattended mode to remove the service pack. If you use this option, then uninstall SP1, only fatal errors will only display the prompt. /Q Press the quiet mode to remove SP1, this...

CVE-2007-3581

The CVE-2007-3581 entry concerns the Jedox Palo 1.5 client. Vulnerability: the client transmits the password in cleartext over the network, which could allow an attacker to obtain the password by sniffing traffic (as illustrated by the scenario with Excel and the Palo plugin). Impact: potential c...

CVE-2007-1462

The luci server component in conga preserves the password between page loads for the Add System/Cluster task flow by storing the password in the Value attribute of a password entry field, which allows attackers to steal the password by performing a "view source" or other operation to obtain the w...

[Full-disclosure] Quicksilver Social Bookmark plugin v.8F: password in clear text

Quicksilver http://quicksilver.blacktree.com/ is a tool to quickly find/launch/do anything you like with all kind of files, bookmarks etcpp on MacOSX =10.3 There exists a plug-in "Social Bookmarks" to integrate and search del.icio.us bookmarks. In version 8F this plugin logs the username and...

CVE-2006-6964

MailEnable Professional prior to v1.78 contains an information disclosure vulnerability: when an administrator edits a user’s settings, a cleartext user password is exposed in the HTML source. This allows remote authenticated administrators to obtain sensitive information. The affected product/co...