[SA13803] Sun SMC GUI Account With Empty Password Creation Security Issue

TITLE: Sun SMC GUI Account With Empty Password Creation Security Issue SECUNIA ADVISORY ID: SA13803 VERIFY ADVISORY: http://secunia.com/advisories/13803/ CRITICAL: Moderately critical IMPACT: Security Bypass WHERE: From remote OPERATING SYSTEM: Sun Solaris 8 http://secunia.com/product/94/ Sun...

Sun Solaris SMC (Solaris Management Console) weak passwords

Under certain conditions user accouint configured with password aging is created with empty password...

[Full-Disclosure] Xanga Cookie Stealing Vunerability XSS - GNAA Security Center

Vendor: Xanga URL: http://www.xanga.com/ Versions: Current Remote: Yes vendor notified: 06 Oct 2004 at 14:08 Vendor response: NONE Summary: Xanga is a fully featured blogging system, it provides great control over look & feel of a users blog by allowing HTML with only basic checks. Xanga has well...

[Full-Disclosure] Xanga Login Cookie stealing Vunerability - GNAA Security Center

Vendor: Xanga URL: http://www.xanga.com/ Versions: Current Remote: Yes vendor notified: 06 Oct 2004 at 14:08 Vendor response: NONE Summary: Xanga is a fully featured blogging system, it provides great control over look & feel of a users blog by allowing HTML with only basic checks. Xanga has well...

rssh -- format string vulnerability

There is a format string bug in rssh that enables an attacker to execute arbitrary code from an account configured to use rssh. On FreeBSD it is only possible to compromise the rssh running account, not root...

Linux User Account Activity Delete User (via Splunk): audit (DEL_USER, not found)

Binary data 710034.prm...

Linux User Account Activity Create User (via Splunk): useradd, plain

Binary data 710012.prm...

IpSwitch IMail Server <= ver 8.1 User Password Decryption

Hi fellaz, IpSwitch IMail Server version up to 8.1 uses weak encryption algorithm to encrypt its user passwords. Have a look at attached proof of concept tool, which will decrypt user password from local machine instantly. --- G:xploitsimaildecrypt G:xploitsimaildecryptimailpwdump -d --= IpSwitch...

CVE-2004-1703

Fusion News 3.6.1 allows remote attackers to add user accounts, if the administrator is logged in, via a comment that contains an img bbcode tag that calls index.php with the signup action, which is executed when the administrator's browser loads the page with the img tag...

PT-2004-2607 · Fusion · Fusion News

Name of the Vulnerable Software and Affected Versions: Fusion News version 3.6.1 Description: The issue allows remote attackers to add user accounts if the administrator is logged in. This can be achieved by including an img bbcode tag in a comment that calls index.php with the signup action. The...

RHEL 2.1 : shadow-utils (RHSA-2003:058)

Updated shadow-utils packages are now available. These updated packages correct a bug that caused the useradd tool to create mail spools with incorrect permissions. The shadow-utils package includes programs for converting UNIX password files to the shadow password format, plus programs for...

Usermin: Multiple vulnerabilities

Background Usermin is a web-based administration tool for Unix. It supports a wide range of user applications including configuring mail forwarding, setting up SSH or reading mail. Description Usermin contains two security vulnerabilities. One fails to properly sanitize email messages that contai...

Cisco Security Advisory: Unity Vulnerabilities on IBM-based Servers

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Cisco Security Advisory: Unity Vulnerabilities on IBM-based Servers Revision Numeral 1.0 For Public Release 2003 December 10 17:00 UTC GMT ======================================================================== Contents ======== Summary Affected...

Apache 1.3.*-2.0.48 mod_userdir Remote Users Disclosure Exploit

Exploit for linux platform in category remote exploits =============================================================== Apache 1.3.-2.0.48 moduserdir Remote Users Disclosure Exploit =============================================================== / m00-apache-w00t.c Apache 1.3.-2.0.48 remote users...

Applied Watch Command Center 1.0 - Authentication Bypass (1)

Applied Watch Command Center 1.0 - Authentication Bypass 1 // source: https://www.securityfocus.com/bid/9124/info A vulnerability has been identified in the system that may allow an attacker to bypass authentication to add attacker supplied IDS alerts and new user accounts in the console...

Poster.Version:Two Setup Vulnerability

Author: DarkKnight My site: http://www.insecureonline.com Product: Poster.version:two Side Note: This is my first post ever on bugtraq, so bear with me. Vendors: Contacted A vulnerability exists within Poster.version:two that allows a remote attacker to add accounts to a Poster.version:two. The...

Drupal XSS Vulnerability (main page and sub pages)

------------------------------------------------------ Drupal XSS Vulnerability main page and sub pages ------------------------------------------------------ Any kind of XSS attacks possibility. An attacker could access other users/admin drupal accounts...

IBM AIX "secldapclntd" daemon authentication vulnerability

Overview A vulnerability in the secldapclntd daemon in IBM's AIX operating system could allow unauthorized remote users to modify accounts on the system. Description According to the IBM bulletin for this issue:"The secldapclntd daemon accepts requests from the LDAP load module, forwards requests...

PHP-Nuke 5.6/6.x News Module - 'article.php' SQL Injection

source: https://www.securityfocus.com/bid/7172/info It has been reported that an input validation error exists in the article.php file included with PHPNuke as part of the News module. Because of this, an attacker could send a malicious string through PHPNuke that would allow the attacker to...

List Site Pro 2.0 - User Database Delimiter Injection

source: https://www.securityfocus.com/bid/6685/info List Site PRO is a top site ranking system that counts hits from member sites and then ranks them according to the number of hits. A problem has been reported for List Site PRO that would allow an attacker to inject arbitrary values via html inp...