884 matches found
CVE-2003-0968
Stack-based buffer overflow in SMBLogonServer of the rlmsmb experimental module for FreeRADIUS 0.9.3 and earlier allows remote attackers to execute arbitrary code via a long User-Password attribute...
[Hat-Squad] phpBB search_id injection exploit
Hello list, Here is the exploit code for phpbb 2.06 sql injection described in http://www.securityfocus.com/archive/1/345872 . It will return MD5 password hash of specified user as highlight variable for viewtopic.php in search results page...
[Full-Disclosure] VieNuke VieBoard SQL Injection Vulnerability... again
--- http://www.securityfocus.com/bid/8967/info/ ... Solution: VieNuke has released a patch: http://www.vienuke.com/VieBoardPatch.zip ... --- http://www.securityfocus.com/bid/8967/solution/ ... VieNuke VieBoard 2.6 Beta 1: VieNuke Patch VieBoardPatch.zip http://www.vienuke.com/VieBoardPatch.zip...
Planet switches - 2 серия
Добрый день. Если помните, http://www.security.nnov.ru/search/news.asp?binid=3174 Та же "закладка" присутствует в Planet WSW-2401. Тот же пользователь, тот же пароль. Проблема усугубляется тем, что управляющий IP-интерфейс доступен через ЛЮБОЙ 802.1q-VLAN, присутствующий в свитче. Это касается и...
e107 db.php User Database Disclosure
The version of e107 installed on the remote host is affected by an information disclosure vulnerability because of a flaw in the 'admin/db.php' script. This can allow an unauthenticated, remote attacker to obtain a dump of the SQL database used by e107, by sending a specially crafted request. An...
Asus AAM6000EV ADSL Router Wide Open
Asus have been notified but haven't even acknowledged yet alone mentioned a fix. If the inbuilt webserver is activated, anyone on the local network can get the full user/pass list from the router without any identification whatsoever by going to the ip address of the router and appending /userdat...
Information Disclosure Vulnerability in board51, forum51 and news51
================================================ ------------------------------------------------ ------------www.bright-shadows.net------------ ------------------------------------------------ --------------theblacksheep&erik-------------- ------------------------------------------------...
phpBB 2.0.5 SQL Injection password disclosure Exploit
No description provided by source. !/usr/bin/perl -w phpBB password disclosure vuln. - rick patel There is a sql injection vuln which exists in /viewtopic.php file. The variable is $topicid which gets passed directly to sql server in query. Attacker could pass a special sql string which can used ...
phpBB 2.0.5 SQL Injection password disclosure Exploit
Exploit for unknown platform in category web applications ===================================================== phpBB 2.0.5 SQL Injection password disclosure Exploit ===================================================== !/usr/bin/perl -w phpBB password disclosure vuln. - rick patel There is a sql...
phpBB 2.0.5 - SQL Injection Password Disclosure
phpBB 2.0.5 - SQL Injection Password Disclosure !/usr/bin/perl -w phpBB password disclosure vuln. - rick patel There is a sql injection vuln which exists in /viewtopic.php file. The variable is $topicid which gets passed directly to sql server in query. Attacker could pass a special sql string...
FlashFXP 1.4 - User Password Encryption
FlashFXP 1.4 - User Password Encryption // source: https://www.securityfocus.com/bid/7499/info FlashFXP uses a trivially reversible algorithm to encrypt FTP user credentials. Local attackers with access to the sites.data may exploit this weakness to gain unauthorized access to FTP user credential...
Entrust Authority Security Manager (EASM) does not enforce multiple authorization requirement for master user password change
Overview Entrust Authority Security Manager contains a vulnerability that could allow a master user to change the password of another master user. A master user could exploit this vulnerability to perform operations that otherwise require authorization by multiple master users. Description Entrus...
Cisco VPN 3000 Concentrator HTML Source Plaintext User Password Disclosure (CSCdv88230, CSCdw22408)
The remote VPN concentrator discloses the passwords of its users in the source HTML of the embedded web server. This vulnerability is documented as Cisco bug ID CSCdv88230 and CSCdw22408. C Tenable Network Security, Inc. Thanks to Nicolas FISCHBACH [email protected] for his help Ref:...
Ecardis Password Reseting Vulnerability
Hi, I don't know if someone has discovered this before but Ecartis 1.0.0 former listar contains a vulnerability that enables an attacker to reset passwords of any user defined on the list server, including the list admins. After logging on as a non-priviledged user, Ecartis enables the user to...
PHP-Board 1.0 - User Password Disclosure
PHP-Board 1.0 - User Password Disclosure source: https://www.securityfocus.com/bid/6862/info php-board user information is stored in flat files on the system hosting the software. Access to the files via the web is not sufficiently restricted. Remote attackers may request user files and gain acce...
PHP-Board 1.0 - User Password Disclosure
source: https://www.securityfocus.com/bid/6862/info php-board user information is stored in flat files on the system hosting the software. Access to the files via the web is not sufficiently restricted. Remote attackers may request user files and gain access to php-board user and administrative...
BEA WebLogic Server "ResourceAllocationException" exception may disclose user password
Overview A vulnerability in BEA's WebLogic Server may disclose sensitive information. Description From the BEA WebLogic Server 7.0 Overview:BEA WebLogic Server is a fully featured, standards-based application server providing the foundation on which an enterprise can build its applications. BEA...
iDEFENSE Security Advisory 10.31.02c: PHP-Nuke SQL Injection Vulnerability
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 iDEFENSE Security Advisory 10.31.02c: http://www.idefense.com/advisory/10.31.02c.txt PHP-Nuke SQL Injection Vulnerability October 31, 2002 I. BACKGROUND "PHP-Nuke is a news automated system specially designed to be used in Intranets and Internet. The...
Ingenium Admin Password Vulnerability
The vendor was contacted, but I have not received any response other than an autoresponder over the past week... -E Security Advisory -- Click2Learn's Ingenium LMS Brian Enigma [email protected] http://netninja.com/papers/ingenium/ ----------------------- OVERVIEW ----------------------- Produc...