2129 matches found
Keep track of skipped the Windows System log on automatically-bug warning-the black bar safety net
Windows family all members in the system go to the desktop before, will pop up a user login interface, requires the user to enter a user name and password, only the input is correct before entering the system. This mechanism undoubtedly greatly enhance the security of the system, but for the...
Login Manager Multiple HTML Injections
Login Manager Multiple HTML Injections Login Manager is a powerful, robust system that enables web administrators to manage website user accounts easily, create membership protected areas, and effortlessly prevent unauthorized user access to secured areas. Login Manager 3 “LM3” uses PHP and MySQL...
CVE-2006-6683
Pedro Lineu Orso chetcpasswd 2.4.1 and earlier verifies and updates user accounts via custom code that processes /etc/shadow and does not follow the PAM configuration, which might allow remote attackers to bypass intended restrictions implemented through PAM...
Chetcpasswd 2.x: multiple vulnerabilities
From Debian.org: "chetpasswd uses the HTTPXFORWARDEDFOR for authentication purposes.... Obviously, HTTPXFORWARDEDFOR is not a trusted variable, and can be spoofed by any scriptkiddie who can read the man page of wget .... Furthermore, this cgi script doesn't seem to implement any rate limiting fo...
CVE-2006-5909
generaloptions.php in Paul Tarjan Stanford Conference And Research Forum SCARF before 20070227 does not require the admin privilege, which allows remote attackers to reconfigure the application or its user accounts...
CVE-2006-5909
CVE-2006-5909 concerns Paul Tarjan’s Stanford Conference And Research Forum (SCARF) prior to 20070227. The vulnerability is in generaloptions.php, which does not require admin privilege, allowing remote attackers to reconfigure the application or its user accounts. The available sources (NVD/NVD-...
CVE-2006-5597
join.asp in MiniHTTP Web Forum & File Server PowerPack 4.0 allows remote attackers to add or modify arbitrary user accounts via modified 1 frmMailBox and 2 frmUserPass parameters...
CVE-2006-5597
CVE-2006-5597 affects MiniHTTP Web Forum & File Server PowerPack 4.0. The join.asp endpoint is vulnerable to remote manipulation of user accounts via modified parameters (1) frmMailBox and (2) frmUserPass), allowing an attacker to add or modify arbitrary accounts. The description and references i...
CVE-2006-5597
join.asp in MiniHTTP Web Forum & File Server PowerPack 4.0 allows remote attackers to add or modify arbitrary user accounts via modified 1 frmMailBox and 2 frmUserPass parameters...
CVE-2006-3939
ScriptsCenter ezUpload Pro 2.2.0 allows remote attackers to perform administrative activities without authentication in 1 filter.php, which permits changing the Extensions Mode file type; 2 access.php, which permits changing the Protection Method; 3 edituser.php, which permits adding upload...
CVE-2006-3939
ScriptsCenter ezUpload Pro 2.2.0 allows remote attackers to perform administrative activities without authentication in 1 filter.php, which permits changing the Extensions Mode file type; 2 access.php, which permits changing the Protection Method; 3 edituser.php, which permits adding upload...
CVE-2006-3829
Cross-site request forgery CSRF vulnerability in bmc/admin.php in Kailash Nadh boastMachine formerly bMachine 3.1 and earlier allows remote attackers to perform unauthorized actions as an administrator and delete arbitrary user accounts via a deleteuser action...
USN-290-1: awstats vulnerability
Hendrik Weimer discovered a privilege escalation vulnerability in awstats. By supplying the 'configdir' CGI parameter and setting it to an attacker-controlled directory such as an FTP account, /tmp, or similar, an attacker could execute arbitrary shell commands with the privileges of the web serv...
shadow: Privilege escalation
Background shadow provides a set of utilities to deal with user accounts. Description When the mailbox is created in useradd, the "open" function does not receive the three arguments it expects while OCREAT is present, which leads to random permissions on the created file, before fchmod is...
NeoMail neomail.pl sort Parameter XSS
The remote host is running NeoMail, an open source webmail application written in Perl. The installed version of this software fails to validate the 'sort' parameter in the 'neomail.pl' script before using it to generate dynamic content. An attacker may be able to exploit this issue to inject...
Security Best Practice: Protection against CIFS Brute-Force Attacks
CIFS is an extension to the Message Block Server SMB protocol, a network protocol native to Windows systems which allows sharing of files and printers across a network. In recent years we have witnessed various worms attempting to compromise and spread through Windows machines with weak, default...
MySQL 5.0 information leak?
Hi. I just upgraded to mysql 5.0.18 and started using all those cool new features. : But concerning VIEWs, I think the informationschema is too verbose to the user. I started creating a VIEW that searches information from several tables, mangles the data and gives the user a clean table with his...
Windows password weakness
Added: 12/19/2005 CVE: CVE-1999-0503 Background Passwords are the most commonly used method of authenticating users to a server. The combination of a login name and password is used to verify the identity of a user requesting access, and to determine what parts of the server the user has permissi...