CVE-2012-2746

CVE-2012-2746 affects 389-ds-base/Red Hat Directory Server prior to 1.2.11.6: when an LDAP user password is changed and audit logging is enabled, the new password is saved to logs in plain text, permitting remote authenticated users to read it. Affected version note appears in multiple advisories...

CVE-2012-2678

389 Directory Server before 1.2.11.6 aka Red Hat Directory Server before 8.2.10-3, after the password for a LDAP user has been changed and before the server has been reset, allows remote attackers to read the plaintext password via the unhasheduserpassword attribute...

CVE-2012-2678

389 Directory Server before 1.2.11.6 aka Red Hat Directory Server before 8.2.10-3, after the password for a LDAP user has been changed and before the server has been reset, allows remote attackers to read the plaintext password via the unhasheduserpassword attribute...

RSA SecurIDs Get Cracked In 13 Minutes

RSA SecurIDs Get Cracked In 13 Minutes Major corporations, government agencies, and small businesses all hand out RSA SecurID fob keychains to employees so that they can log in to their systems for security reasons and If you're used to seeing a device like this on a daily basis, you probably...

rhds/389: plaintext password disclosure flaw

389 Directory Server before 1.2.11.6 aka Red Hat Directory Server before 8.2.10-3, after the password for a LDAP user has been changed and before the server has been reset, allows remote attackers to read the plaintext password via the unhasheduserpassword attribute...

rhds/389: plaintext password disclosure in audit log

389 Directory Server before 1.2.11.6 aka Red Hat Directory Server before 8.2.10-3, when the password of a LDAP user has been changed and audit logging is enabled, saves the new password to the log in plain text, which allows remote authenticated users to read the password...

GLSA-201206-33 : Postfix: Multiple vulnerabilities

The remote host is affected by the vulnerability described in GLSA-201206-33 Postfix: Multiple vulnerabilities A vulnerability have been discovered in Postfix. Please review the CVE identifier referenced below for details. Impact : An attacker could perform a man-in-the-middle attack and inject...

RHEL 6 : 389-ds-base (RHSA-2012:0997)

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2012:0997 advisory. - rhds/389: plaintext password disclosure flaw CVE-2012-2678 - rhds/389: plaintext password disclosure in audit log CVE-2012-2746 Note that...

rhds/389: plaintext password disclosure flaw

389 Directory Server before 1.2.11.6 aka Red Hat Directory Server before 8.2.10-3, after the password for a LDAP user has been changed and before the server has been reset, allows remote attackers to read the plaintext password via the unhasheduserpassword attribute...

Mac OS X FileVault Plaintext Password Logging

Plaintext passwords were discovered in a system log file. Mac OS X Lion release 10.7.3 enabled a debug logging feature that causes plaintext passwords to be logged to /var/log/secure.log on systems that use certain FileVault configurations. A local attacker in the admin group or an attacker with...

Apple Legacy filevault barn door...

As someone said here recently, carefully built crypto has a unfortunate tendency to consist of three thick impregnable walls and a picket fence in the back with the gate left open. That seems to have happened to Apple's older "legacy" Filevault in the current release of MacOX Lion 10.7.3...

Flaw in OS X Lion Encryption Leaves User Credentials in Plaintext

There’s a serious weakness in certain versions of Apple OS X that causes the operating system to store users’ login credentials for the FileVault encrypted storage in plaintext. The bug, which is found in older versions of FileVault present on OS X Lion 10.7.3 systems, enables anyone with admin...

Lynx Message Server - Multiple Vulnerabilities

Lynx Message Server - Multiple Vulnerabilities 1. Summary The Micro Technology Services Inc. "Lynx Message Server 7.11.10.2" and/or "LynxTCPService version 1.1.62" web interface is vulnerable to SQL Injection, Cross-Site Scripting, and other security problems. 2. Description Lynx is a "Facility...

Lynx Message Server 7.11.10.2 Cross Site Scripting / SQL Injection

Summary The Micro Technology Services Inc. "Lynx Message Server 7.11.10.2" and/or "LynxTCPService version 1.1.62" web interface is vulnerable to SQL Injection, Cross-Site Scripting, and other security problems. 2. Description Lynx is a "Facility wide Duress and Emergency Notification" system...

Survey Finds Secure Sites Not So Secure

A new project that was setup to monitor the quality and strength of the SSL implementations on top sites across the Internet found that 75 percent of them are vulnerable to the BEAST SSL attack and that just 10 percent of the sites surveyed should be considered secure. The SSL Pulse project, set ...

Google Talk gtalk:// Deprecated Uri Handler Parameter Injection Vulnerability

No description provided by source. Google Talk gtalk:// Deprecated Uri Handler /gaiaserver Parameter Injection Vulnerability tested against: Internet Explorer 8 Microsoft Windows all versions download url of 1.0.0.104: http://www.google.com/talk/install.html download urls of 1.0.0.105:...

Hacker exposes 40,000 Credit Cards from Digital Playground

Hacker exposes 40,000 Credit Cards from Digital Playground A new hacking group called The Consortium has hit the scene and their first take down is the porn site Digital Playground deface it and Mirror is available here. Everything, including credit card information, was stored in plain text. "Th...

Unfamiliar street plaintext submit the registration information of the plaintext transmission-vulnerability warning-the black bar safety net

Unfamiliar Street is Beijing, unfamiliar street Technology Co., Ltd. launched a location-based mobile social products. Its login authentication using a cleartext user ID and password. Detailed description: Unfamiliar Street is Beijing, unfamiliar street Technology Co., Ltd. launched a...

OpenSSL: Multiple vulnerabilities

Background OpenSSL is an Open Source toolkit implementing the Secure Sockets Layer SSL v2/v3 and Transport Layer Security TLS v1 as well as a general purpose cryptography library. Description Multiple vulnerabilities have been found in OpenSSL: Timing differences for decryption are exposed by CBC...

Skype v. 5.x.x - information disclosure

Hello, 3APA3A, Title: ====== Skype v. 5.x.x - information disclosure Date: ===== 2012-02-13 Introduction: ============= Skype is a proprietary voice-over-Internet Protocol service and software application. Abstract: ========= We have discovered improper chat logs handling, which cause in logs...