Cisco Secure ACS for Windows information leak

Administration password and encryption key are insecurely stored in HKEYLOCALMACHINE registry key...

IM Lock protection bypass

Decryptable password is stored in world-readable registry key...

Winamp fails to properly handle playlists with long "file" parameter

Overview Winamp contains a buffer overflow vulnerability when processing a playlist that has a long file parameter. This may allow a remote unauthenticated attacker to execute arbitrary code on a vulnerable system. Description Winamp Winamp is a media player for Microsoft Windows systems. It can...

CVE-2006-0363

MSN Messenger 7.5 stores passwords in an encrypted form under HKEY_CURRENT_USER\Software\Microsoft\IdentityCRL\Creds. Local users may recover originals by calling CryptUnprotectData (as demonstrated by the MSN Password Recovery.exe tool). The issue highlights that decryption methods and keys resi...

CVE-2006-0363

The "Remember my Password" feature in MSN Messenger 7.5 stores passwords in an encrypted format under the HKEYCURRENTUSER\Software\Microsoft\IdentityCRL\Creds registry key, which might allow local users to obtain the original passwords via a program that calls CryptUnprotectData, as demonstrated ...

Hack the door cracks（crack installed-the vulnerability warning-the black bar safety net

Some time ago, to see someone in order to hack hack the door to the server end of a password, also specially made a program Haven't come across more than my first, so there is no concern Today good luck, hit one. Oh Start also thinking about how to crack its password: The Read password program id...

CVE-2003-1276

Netfone.exe of NetTelephone 3.5.6 uses weak encryption for user PIN's and stores user account numbers in plaintext in the HKEYCURRENTUSER\Software\MediaRing.com\SDK\NetTelephone\settings registry key, which could allow local users to gain unauthorized access to NetTelephone accounts...

CVE-2005-3474

The CVE-2005-3474 entry concerns the aries.sys driver in Sony First4Internet XCP DRM software. The driver hides any file, registry key, or process whose name begins with "$sys$", enabling an attacker to conceal activity on a system using XCP. Affected component: aries.sys within the XCP DRM stack...

CVE-2005-2120

Stack-based buffer overflow in the Plug and Play PnP service UMPNPMGR.DLL in Microsoft Windows 2000 SP4, and XP SP1 and SP2, allows remote or local authenticated attackers to execute arbitrary code via a large number of "" backslash characters in a registry key name, which triggers the overflow i...

CVE-2005-2120

CVE-2005-2120 is a stack-based buffer overflow in the Windows Plug and Play (PnP) service (UMPNPMGR.DLL) on Windows 2000 SP4 and Windows XP SP1/SP2. The overflow occurs when processing a registry key name containing a large number of backslashes, triggered in wsprintfW, allowing remote or local a...

CVE-2005-2120

Stack-based buffer overflow in the Plug and Play PnP service UMPNPMGR.DLL in Microsoft Windows 2000 SP4, and XP SP1 and SP2, allows remote or local authenticated attackers to execute arbitrary code via a large number of "" backslash characters in a registry key name, which triggers the overflow i...

Microsoft Windows Plug and Play Registry Key Buffer Overflow (MS05-047; CVE-2005-2120)

Plug and Play PnP allows the operating system to detect new hardware e.g a mouse, a digital camera when you install it on a system A vulnerability was detected in the PnP service for several Microsoft Windows operating systems that can allow remote attackers to execute arbitrary code via a crafte...

CVE-2005-3036

File Transfer Anywhere 3.01 stores sensitive password information in plaintext in the PASS value in the "File Transfer Anywhere" registry key, which allows local users to gain privileges...

CVE-2005-3036

CVE-2005-3036 affects File Transfer Anywhere 3.01, where a sensitive password is stored in plaintext in the PASS value of the program’s registry key. The root cause is plaintext credential storage in the registry, enabling local users to gain privileges. Impact: local privilege escalation as desc...

CVE-2005-2859

Savant Web Server stores user credentials in plaintext in the Savant\Users registry key, which allows local users to gain privileges...

CVE-2005-2866

Mercora IMRadio 4.0.0.0 stores usernames and passwords in plaintext in the MercoraClient\Profiles registry key, which allows local users to gain privileges...

CVE-2005-2859

Savant Web Server stores user credentials in plaintext in the Savant\Users registry key, which allows local users to gain privileges...

[SA15932] Access Remote PC User Credentials Disclosure

---------------------------------------------------------------------- Bist Du interessiert an einem neuen Job in IT-Sicherheit? Secunia hat zwei freie Stellen als Junior und Senior Spezialist in IT- Sicherheit: http://secunia.com/secuniavacancies/...

CVE-2002-1946

Videsh Sanchar Nigam Limited VSNL Integrated Dialer Software 1.2.000, when the "Save Password" option is used, stores the password with a weak encryption scheme one-to-one mapping in a registry key, which allows local users to obtain and decrypt the password...

CVE-2002-1946

The CVE-2002-1946 entry applies to Videsh Sanchar Nigam Limited (VSNL) Integrated Dialer Software version 1.2.000. The issue is that when the Save Password option is used, the password is stored in the registry using a weak, one-to-one encryption scheme, allowing local users to obtain and decrypt...