Privilege Escalation Vulnerability In phpBB 2.0.0

Privilege Escalation Vulnerability In phpBB 2.0.0 ------------------------------------------------- Rootsecure.net recently found a privilege escalation vulnerability in "phpBB 2.0.0" which allows any person with a "user" level account to escalate their privileges to that of "administrator" level...

x_news allows unauthorized users to access administrative menu

Overview xnews allows a user to authenticate without supplying the user's plaintext password. Description xnews is a system for managing news. When a user logs in to xnews version 1.1 using a plaintext password, xnews hashes the password with MD5 and compares it to user's hash stored in the file...

UoW IMAPd Server 10.23412.264 - Remote Buffer Overflow

UoW IMAPd Server 10.23412.264 - Remote Buffer Overflow // source: https://www.securityfocus.com/bid/1110/info A buffer overflow exists in imapd. The vulnerability exists in the list command. By supplying a long, well-crafted string as the second argument to the list command, it becomes possible t...

CVE-2002-0097

Geeklog 1.3 allows remote attackers to hijack user accounts, including the administrator account, by modifying the UID of a user's permanent cookie to the target account...

Problem when signing up for new user Account from login page

I signed up for a new user account from the login page, filled in a username, password, name and e-mail. Then I tried to login with the new username and got this exception: java.lang.NullPointerException at com.opensymphony.module.user.User.getGroupsUser.java:94 at...

Problem when signing up for new user Account from login page

I signed up for a new user account from the login page, filled in a username, password, name and e-mail. Then I tried to login with the new username and got this exception: java.lang.NullPointerException at com.opensymphony.module.user.User.getGroupsUser.java:94 at...

Security holes : XMB Magic Lantern forum & DevBB

Hi all : Product 1 : XMB Magic Lantern forum 1.6b final http://www.xmbforum.com http://www.aventure-media.co.uk Problems : - Reading of logs files - XSS - Path Disclosure - Access to users/admins accounts - Logs distortion Exploits : - /indexlog.log - /cplogfile.log - If indexlog not chmod 777 =...

Unauthorized access via starscream/skank in ISS RealSecure

In default installation addtional rights are granted to user account skank from starscream host...

User account DoS in Oblix NetPoint

User account is blocked after few unsuccessfull logon atempts...

CVE-2001-0001

cookiedecode function in PHP-Nuke 4.4 allows users to bypass authentication and gain access to other user accounts by extracting the authentication information from a cookie...

OS/400 - User Account Name Disclosure

source: https://www.securityfocus.com/bid/4059/info AS/400 is a midrange computer platform developed by IBM. It is designed to be highly reliable and efficient, and uses the OS/400 operating system. An information disclosure vulnerability has been reported to exist in OS/400 systems. An...

OS400 - User Account Name Disclosure

OS400 - User Account Name Disclosure source: https://www.securityfocus.com/bid/4059/info AS/400 is a midrange computer platform developed by IBM. It is designed to be highly reliable and efficient, and uses the OS/400 operating system. An information disclosure vulnerability has been reported to...

Security Advisory for Bugzilla v2.15 (cvs20020103) and older

All users of Bugzilla, the bug-tracking system from mozilla.org, who are using a version of Bugzilla installed from a downloaded tarball or package file are strongly recommended to update to version 2.14.1. All users of Bugzilla who are currently using version 2.15 checked out of cvs prior to 15...

CVE-2001-1571

The Remote Desktop client in Windows XP sends the most recent user account name in cleartext, which could allow remote attackers to obtain terminal server user account names via sniffing...

CVE-2001-1483

One-Time Passwords In Everything a.k.a OPIE 2.32 and 2.4 allows remote attackers to determine the existence of user accounts by printing random passphrases if the user account does not exist and static passphrases if the user account does exist...

EFTP 2.0.8.346 directory content disclosure

There exists a vulnerability in EFTP 2.0.8.346 Vendor notified: 12/12/2001 Vendor reply/fix: 12/12/2001 Vendor Homepage: http://www.eftp.org/ Platforms tested: windows nt 4 /sp6 windows 2000 /sp2 windows XP ----------= Program info =---------- From vendor homepage: "Encrypted File Transfer...

F5 Device Default Support Password

The remote F5 Networks device has the default password set for the 'support' user account. This account normally provides read/write access to the web configuration utility. An attacker could take advantage of this to reconfigure your systems and possibly gain shell access to the system with...

DCForum Remote Admin Privilege Compromise Vulnerability

Vulnerable: DC Scripts DCForum 2000 1.0 DC Scripts DCForum 6.0 DCForum is a commercial cgi script from DCScripts which is designed to facilitate web-based threaded discussion forums. Versions of DCForum are vulnerable to attacks which can yield an elevation of privileges and remote execution of...

CVE-1999-1231

CVE-1999-1231 affects SSH 2.0.12 (and possibly later versions). The vulnerability arises because an attacker can try multiple password attempts using valid usernames, yet the system only prompts “invalid user” once, enabling remote disclosure of valid account names on the server. The description ...

CVE-1999-1231

ssh 2.0.12, and possibly other versions, allows valid user names to attempt to enter the correct password multiple times, but only prompts an invalid user name for a password once, which allows remote attackers to determine user account names on the server...