CVE-2006-1059

CVE-2006-1059 affects Samba up to 3.0.21c: winbindd writes the machine trust account password in cleartext to log files, allowing local users to obtain the password and spoof the domain server. OpenVAS notes the exposure of machine account credentials in winbind logs. The provided documents do no...

CVE-2006-0633

The CVE concerns Invision Power Board (IPB) 2.1.4, where the make_password function in ipsclass.php generates the authentication code sent to users with lost passwords from random data derived from partially predictable seeds. This may allow remote attackers to guess the code and change an IPB ac...

Design/Logic Flaw

The cryptgensalt functions for BSDI-style extended DES-based and FreeBSD-sytle MD5-based password hashes in cryptblowfish 0.4.7 and earlier do not evenly and randomly distribute salts, which makes it easier for attackers to guess passwords from a stolen password file due to the increased number o...

CVE-2006-0363

MSN Messenger 7.5 stores passwords in an encrypted form under HKEY_CURRENT_USER\Software\Microsoft\IdentityCRL\Creds. Local users may recover originals by calling CryptUnprotectData (as demonstrated by the MSN Password Recovery.exe tool). The issue highlights that decryption methods and keys resi...

From the background to give the webshell tips great summary-vulnerability warning-the black bar safety net

Foreword Moving webonexploit, I believe we scored a lot of chickens. Can say ismoving weblet upfile. asp Upload file filter is not strict. vulnerabilitysho ran the world, Now thisvulnerabilityhas been substantially more difficult to meet, do not rule out some small sites still exist for...

CVE-2005-2739

CVE-2005-2739 affects Keychain Access on Mac OS X 10.4.2 and earlier, where a password may remain visible if a keychain times out during viewing. This could allow someone with physical access to see the password. The issue is addressed by Apple in the Mac OS X 10.4.3 update (and related 10.4.x pa...

CVE-2004-2414

Novell NetWare 6.5 SP 1.1, when installing or upgrading using the Overlay CDs and performing a custom installation with OpenSSH, includes sensitive password information in the 1 NIOUTPUT.TXT and 2 NI.LOG log files, which might allow local users to obtain the passwords...

CVE-2002-2119

CVE-2002-2119 affects Novell eDirectory 8.6.2 and 8.7, where use of case-insensitive passwords enables remote brute-force password guessing. Root cause: password comparisons are not case-sensitive. Impact: higher risk of successful credential guessing (remote). Connected sources corroborate the a...

Trillian Ver 3.1 saves password's in plain Text

Hi Everyone, I was playing around with Trillian Pro 3.1 Build 121 and noticed a very disturbing behavior when using it to check my yahoo mail. When you choose the option to check your yahoo email from Trillian The little connection ball - Check Yahoo Mail it creates a temp file in the Install...

Linux Add User

Create a new user with UID 0 This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework AddUser ------- Adds a UID 0 user to /etc/passwd. module MetasploitModule CachedSize = 97 include Msf::Payload::Single include...

CVE-2001-1546

Pathways Homecare 6.5 is affected by a vulnerability where weak encryption protects usernames and passwords, enabling local attackers to recover credentials from the pwhc.ini file and gain privileges. Affected component: Pathways Homecare 6.5; root cause: weak encryption/storage of credentials in...

BlogTorrent <= 0.92 Remote Password Disclosure Exploit

Exploit for unknown platform in category web applications ====================================================== BlogTorrent 14ae696abdca1688dd577fe486c3981f331457b0d7 Password crypt in md5 - d7b82821fe725305bded2fab9e91ed1e0e6fd93bee LazyCrsATGMailDOTcom - pjphemATmyboxDOTit FREE RAFA! FREE RAFA...

wordpress1512.txt

GulfTech Security Research June 28th, 2005 Vendor : WordPress URL : http://wordpress.org/ Version : WordPress 1.5.1.2 && Earlier Risk : Multiple Vulnerabilities Description: WordPress is a very popular personal publishing platform aka blog software, and is used by everyone from celebrities, to...

CVE-2005-2069

pamldap and nssldap, when used with OpenLDAP and connecting to a slave using TLS, does not use TLS for the subsequent connection if the client is referred to a master, which may cause a password to be sent in cleartext and allows remote attackers to sniff the password...

CVE-2002-1949

CVE-2002-1949 affects Iomega NAS A300U Admin Web Page, where credentials are transmitted in cleartext over the network, enabling remote password sniffing. Connected docs corroborate the issue and provide limited remediation guidance: IBM bulletin notes remediations for Jazz Foundation products (u...

Ultimate PHP Board <= 1.9.6 GOLD users.dat Password Decryptor

Exploit for unknown platform in category web applications ============================================================= Ultimate PHP Board = 1.9.6 GOLD users.dat Password Decryptor ============================================================= !/usr/bin/perl Passwords Decrypter for UPB = 1.9.6...

CVE-2004-1861

CVE-2004-1861 relates to Invision NetSupport School Pro, which uses a weak encryption algorithm to encrypt passwords, enabling local users to obtain passwords. The available documents state the affected product and the underlying issue (weak encryption) but do not specify the exact vulnerable com...

CVE-2005-1062

Kerio’s administration protocol in Kerio WinRoute Firewall &lt;= 6.0.10, Kerio Personal Firewall &lt;= 4.1.2, and Kerio MailServer

CVE-2001-1476

CVE-2001-1476: SSH implementations prior to 2.0 using RC4 with the disallow NULL passwords option are vulnerable to remote session replay that can reveal parts of user passwords via modified attempts and the login message behavior. Root cause is a flaw in session handling under these conditions, ...

CVE-2001-1436

The CVE concerns the Dallas Semiconductor iButton DS1991, where an incorrect password yields predictable values, enabling dictionary attacks by anyone with physical access. Affected: DS1991 device. The issue stems from password handling that allows predictable outputs, impacting confidentiality, ...