CVE-2004-1852: Cleartext Transmission of Sensitive Information

DameWare Mini Remote Control 3.x before 3.74 and 4.x before 4.2 transmits the Blowfish encryption key in plaintext, which allows remote attackers to gain sensitive information...

leafnode -- fetchnews denial-of-service triggered by transmission abort/timeout

When an upstream server aborts the transmission or stops sending data after the fetchnews program has requested an article header or body, fetchnews may crash, without querying further servers that are configured. This can prevent articles from being fetched...

CVE-2001-1463

The remote administration client for RhinoSoft Serv-U 3.0 sends the user password in plaintext even when S/KEY One-Time Password OTP authentication is enabled, which allows remote attackers to sniff passwords...

FreeBSD-SA-05:02.sendfile

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ============================================================================= FreeBSD-SA-05:02.sendfile Security Advisory The FreeBSD Project Topic: sendfile kernel memory disclosure Category: core Module: syskern Announced: 2005-04-04 Credits: Sven...

CVE-2004-0872

CVE-2004-0872 affects Opera and describes a cookie handling flaw where cookies sent over an insecure channel (HTTP) can also be presented on a secure channel (HTTPS/SSL) within the same domain. This enables potential cookie leakage and unauthorized session usage (Cross Security Boundary Cookie In...

CVE-2004-0871

Mozilla does not prevent cookies that are sent over an insecure channel HTTP from also being sent over a secure channel HTTPS/SSL in the same domain, which could allow remote attackers to steal cookies and conduct unauthorized activities, aka "Cross Security Boundary Cookie Injection."...

CVE-2004-2578

phpGroupWare before 0.9.16.002 transmits the 1 header admin and 2 setup passwords in plaintext via cookies, which allows remote attackers to sniff passwords...

CVE-2004-2421

Unknown vulnerability in Hitachi Job Management Partner JP1 JP1/File Transmission Server/FTP 6 and 7, when running on HP-UX in trusted mode, allows attackers to bypass authentication and gain administrator rights...

security flaw

statd in nfs-utils 1.257 and earlier does not ignore the SIGPIPE signal, which allows remote attackers to cause a denial of service server process crash via a TCP connection that is prematurely terminated...

DEBIAN-CVE-2004-0230

TCP, when using a large Window Size, makes it easier for remote attackers to guess sequence numbers and cause a denial of service connection loss to persistent TCP connections by repeatedly injecting a TCP RST packet, especially in protocols that use long-lived connections, such as BGP...

Datakeys tokens/smart cards weak encryption

All data between computer and device are transmitted unencrypted...

Mandrake Linux Security Advisory : mgetty (MDKSA-2003:053-1)

Two vulnerabilities were discovered in mgetty versions prior to 1.1.29. An internal buffer could be overflowed if the caller name reported by the modem, via Caller ID information, was too long. As well, the faxspool script that comes with mgetty used a simple permissions scheme to allow or deny f...

CVE-2004-0459

The Clear Channel Assessment CCA algorithm in the IEEE 802.11 wireless protocol, when using DSSS transmission encoding, allows remote attackers to cause a denial of service via a certain RF signal that causes a channel to appear busy aka "jabber", which prevents devices from transmitting data...

CVE-2004-0459

The Clear Channel Assessment CCA algorithm in the IEEE 802.11 wireless protocol, when using DSSS transmission encoding, allows remote attackers to cause a denial of service via a certain RF signal that causes a channel to appear busy aka "jabber", which prevents devices from transmitting data...

IEEE 802.11 wireless network protocol DSSS CCA algorithm vulnerable to denial of service

Overview The IEEE 802.11 wireless networking protocol contains a vulnerability that could allow a remote attacker to cause a denial of service to any wireless device within range. Description IEEE 802.11 wireless network protocols use a Clear Channel Assessment CCA algorithm to determine whether ...

IEEE 802.11 collision avoidance procedure weakness

By using Clear Channel Assessment procedure weakness attacker equipped with standard client card can prevent data transmission over network...

The Border Gateway Protocol relies on persistent TCP sessions without specifying authentication requirements

Overview A vulnerability exists in the reliance of the Border Gateway Protocol BGP on the Transmission Control Protocol TCP to maintain persistent sessions. Sustained exploitation of this vulnerability could lead to a denial-of-service condition affecting a large segment of the Internet community...

RealSecure Blackice - iss_pam1.dll Remote Overflow

RealSecure Blackice - isspam1.dll Remote Overflow / 557isspamexp - RealSecure / Blackice ICQ isspam1.dll remote overflow exploit Copyright c SST 2004 All rights reserved. Public version code by Sam Sam@efnet and 2004/03/26 Compile: gcc -o 557isspamexp 557isspamexp.c how works? root@core exp...

Weak DameWare encryption

Weak PRNG is used for symmetric key generation, key is self is sent in cleartext among data...

Dameware Passes Weak File Encryption Key in the Clear

Dameware Mini Remote Control version 4.1.0.0 and presumably other versions pass a Blowfish encryption key over the wire in the clear. It is bad enough that they appear to be using Blowfish in Electronic Codebook Mode; but they compound their errors by the following two vulnerabilities. The Damewa...