Planetmoon - Guestbook Clear Text Password Retrieval

source: https://www.securityfocus.com/bid/7167/info A vulnerability has been reported in Planetmoon Guestbook. It has been reported that remote users may be able to retrieve clear text password lists. Access to this data may allow an attacker to carry out further attacks against a target user...

CVE-2003-0126

The web interface for SOHO Routefinder 550 firmware 4.63 and earlier, and possibly later versions, has a default "admin" account with a blank password, which could allow attackers on the LAN side to conduct unauthorized activities...

Default Password (guest) for 'guest' Account

The account 'guest' has the password 'guest' set. An attacker may use this to gain further privileges on this system. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. account = "guest"; password = "guest"; include'deprecatednasllevel.inc'; include'compat.inc'; if description scriptid11256;...

iDEFENSE Security Advisory 01.28.03: SSH2 Clients Insecurely Store Passwords

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 iDEFENSE Security Advisory 01.28.03: SSH2 Clients Insecurely Store Passwords AbsoluteTelnet, SecureCRT, Entunnel, SecureFx, and PuTTY http://www.idefense.com/advisory/01.28.03.txt January 28, 2003 I. BACKGROUND PuTTY is a free implementation of Telnet...

CVE-2002-1910

Click2Learn Ingenium Learning Management System 5.1 and 6.1 uses weak encryption for passwords reversible algorithm, which allows attackers to obtain passwords...

CVE-2002-1738

Alt-N Technologies MDaemon 5.0.5.0 and earlier creates a default MDaemon mail account with a password of MServer, which could allow remote attackers to send anonymous email...

CVE-2002-1800

phpRank 1.8 stores the administrative password in plaintext on the server and in the "ap" cookie, which allows remote attackers to retrieve the administrative password...

Vulnerability in Cutecast Forum v1.2

Vulnerability in Cutecast Forum v1.2 You can read passwords of all users. Passwords in Plaintext Exploit: http://www.website.com/cgi-bin/cutecast/members/username.user Zero X, member of www.lobnan.de -- http://www.linuxmail.org/ Now with POP3/IMAP access for only US$19.95/yr Powered by Outblaze...

CVE-2002-1233

A regression error in the Debian distributions of the apache-ssl package before 1.3.9 on Debian 2.2, and before 1.3.26 on Debian 3.0, for Apache 1.3.27 and earlier, allows local users to read or modify the Apache password file via a symlink attack on temporary files when the administrator runs 1...

Ingenium Admin Password Vulnerability

The vendor was contacted, but I have not received any response other than an autoresponder over the past week... -E Security Advisory -- Click2Learn's Ingenium LMS Brian Enigma [email protected] http://netninja.com/papers/ingenium/ ----------------------- OVERVIEW ----------------------- Produc...

CVE-2002-1062

Signedness error in Thomas Hauck Jana Server 2.x through 2.2.1, and 1.4.6 and earlier, allows remote attackers to execute arbitrary code via long 1 Username, 2 Password, or 3 Hostname entries...

0815 ++ */ SEH_Web

Phenoelit Advisory wir-haben-auch-mal-was-gefunden 0815 +--+ Authors FX [email protected] kim0 [email protected] Phenoelit Group http://www.phenoelit.de Advisory http://www.phenoelit.de/stuff/SEHWeb.txt Affected Products SEH GmbH IC9 Pocket Print Server Tested on SEH IC9 Firmware 7.1.30 and 7.1.36f...

Microsoft SQL Server installation process leaves sensitive information on system

Overview Microsoft SQL server versions 7.0 and 2000, as well as MSDE 1.0, may leave installation and log files on the server after the installation process is complete. These files may contain senstitive information such as passwords used during the install. Users with authenticated access to the...

CVE-2002-0394

Red-M 1050 Bluetooth Access Point uses case insensitive passwords, which makes it easier for attackers to conduct a brute force guessing attack due to the smaller space of possible passwords...

CVE-2002-0667

Pingtel xpressa SIP-based voice-over-IP phone 1.2.5 through 1.2.7.4 has a default null administrator password, which could allow remote attackers to gain access to the phone...

3.3/4.0/4.2 MERCUR MailServer - Control-Service Buffer Overflow

// source: https://www.securityfocus.com/bid/5261/info // MERCUR Mailserver is prone to a remotely exploitable buffer overflow condition. The condition is due to insufficient bounds checking in the Control-Service component, which listens on TCP port 32000 by default. It is possible to corrupt...

CVE-2001-0981

HP CIFS/9000 Server SAMBA A.01.07 and earlier with the "unix password sync" option enabled calls the passwd program without specifying the username of the user making the request, which could cause the server to change the password of a different user...

@stake advisory: Multiple Red-M 1050 Blue Tooth Access Point Vulnerabilities

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 @stake, Inc. www.atstake.com Security Advisory Advisory Name: Multiple Red-M 1050 Blue Tooth Access Point Vulnerabilities Issues: Red-M 1050 Access Point Management Web Server DoS Red-M 1050 Access Point Case Insensitive Passwords Red-M 1050 Access...

CVE-2002-0226

retrievepassword.pl in DCForum 6.x and 2000 generates predictable new passwords based on a sessionID, which allows remote attackers to request a new password on behalf of another user and use the sessionID to calculate the new password for that user...

Remote quake 2 3.2x server cvar leak

Hello, A problem exists in the Quake II Server for any OS probably all versions; tested 3.20 and 3.21 discovered by 'Redix' that allows server cvars containing sensitve information to be leaked. This has been known for a little over 2 months, I run several Q2 servers and only learned of it today...