LDAP Connection Leak in CTI when User Authentication Fails

...

WorkforceROI Xpede 4.17.0 - Weak Password Encryption

WorkforceROI Xpede 4.17.0 - Weak Password Encryption source: https://www.securityfocus.com/bid/4344/info An issue has been reported in Xpede, which could lead to a compromise of user authentication information. Reportedly, Xpede cookies containing username and password data is stored using a weak...

WorkforceROI Xpede 4.1/7.0 - Weak Password Encryption

source: https://www.securityfocus.com/bid/4344/info An issue has been reported in Xpede, which could lead to a compromise of user authentication information. Reportedly, Xpede cookies containing username and password data is stored using a weak encryption method. Therefore if a user obtains acces...

Denial of Service in Sphereserver

H Zero Seven Security Advisory 15.02.2002 ------------------------------------------- SphereServer Denial of Service Vulnerability -------------------------------------------- Summary: The SphereServer is an Ultima Online Roleplay Server Multiplayer. Some people use this inofficial Server to host...

Oracle 9i Database Server PL/SQL module allows remote command execution without authentication

Overview Oracle Database Server allows remote users to execute system commands without authenticating. Description Oracle Database Server provides extended functionality through the use of Procedural Language/Structured Query Language PL/SQL libraries. PL/SQL includes commands to load arbitrary...

Security Advisory: Cisco Secure Access Control Server Novell Directory Service Expired/Disabled User Authentication Vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Cisco Security Advisory: Cisco Secure Access Control Server Novell Directory Service Expired/Disabled User Authentication Vulnerability ========================================================================== Revision 1.0 For Public Release 2002 February 07...

Cisco Secure Access Control Server Novell Directory Service Expired/Disabled User Authentication Vulnerability

...

Advanced Poll does not adequately authenticate users

Overview Advanced Poll is a polling system written in PHP for use on web sites. When a flat file database is used, Advanced Poll does not adequately authenticate users, thereby allowing any user to gain Advanced Poll administrative privileges. Description On versions of Advanced Poll older than...

Horde IMP 2.2.x - Session Hijacking

Horde IMP 2.2.x - Session Hijacking source: https://www.securityfocus.com/bid/3525/info IMP is a powerful web-based mail interface/client developed by members of the Horde project. Encoded HTML tags are not stripped from requests to access 'status.php3'. It is possible for a remote attacker to...

Air Messenger LAN Server (AMLServer) stores usernames and passwords in plaintext

Overview Air Messenger LAN Server AMLServer stores usernames and passwords in plaintext. Description AMLServer for windows is a paging gateway that allows users on a TCP/IP LAN to communicate with mobile devices such as phones and pagers. Access to AMLServer's services is protected by a user...

PostNuke 0.6 - User Login

PostNuke 0.6 - User Login source: https://www.securityfocus.com/bid/3435/info PostNuke, successor to PHPNuke, is a content management system written in PHP. PostNuke versions 0.62 to 0.64 suffer from a vulnerability that allows a remote user to log-in as any user with known username and ID withou...

CVE-1999-1133

CVE-1999-1133 affects HP-UX 9.x and 10.x running X Windows. Local attackers can gain privileges via the unauthenticated components vuefile, vuepad, dtfile, or dtpad. The provided sources describe the vulnerable components and the privilege escalation vector but do not specify a patch or remediati...

ISS Security Advisory: Remote Buffer Overflow in Multiple RADIUS Implementations

Internet Security Systems Security Advisory July 5, 2001 Remote Buffer Overflow in Multiple RADIUS Implementations Synopsis: ISS X-Force has discovered buffer overflow vulnerabilities in two popular Remote Authentication Dial-In User Server RADIUS implementations. RADIUS was originally designed t...

Несанкционированный доступ через HTTP в Cisco (unauthorized access).

Можно обойти проверку имени/пароля пользователя...

Rumpus FTP Server 1.3.x2.0.3 - Stack Overflow Denial of Service

Rumpus FTP Server 1.3.x2.0.3 - Stack Overflow Denial of Service source: https://www.securityfocus.com/bid/2864/info Rumpus FTP Server is an implementation for MacOS which allows file-sharing across TCP/IP connections. Rumpus FTP is prone to a denial of service. An ftp user can engage the attack b...

More on Ultimate Bullering Board

In response to Scott Ashman's post about UBB. After i discovered this bug last week i tried to contact infopop on 3 email adresses from their contact page i finally managed to find one that didn't bounce, but i haven't recieved any response yet. Anyway, Scott describes a way to retrieve other...

Adcycle 0.78b Authentication

|---------------------------------------------------------------------------------| / Product: Adcycle Banner Rotation. Vendor URL: www.adcycle.com / Tested on: v0.77 - 0.78b Freeware Linux Vendor Contact: Mailed on 15th January i think Twice with NO reply / Other: Commericial version NOT tested...

WebMaster ConferenceRoom 1.8 Developer Edition - Denial of Service

WebMaster ConferenceRoom 1.8 Developer Edition - Denial of Service source: https://www.securityfocus.com/bid/2178/info WebMaster ConferenceRoom Developer Edition is a chat package which enables a large community of users to chat together. ConferenceRoom has a wide range of capabilities and a user...

Decrypting passwords for SmartServer 3

Product: Smart Server 3 by NetCPlus Version: 3.75 others? OS: Windows NT/2000/9x Description: SmartServer3 SS3 is a small business email server from NetCPlus. It installs by default in C:Program Filessmartserver3 . In this folder it stores a configuration file called 'dialsrv.ini' . This file is...

Brute Forcing FTP Servers with enabled anti-hammering (anti brute-force) modus

Brute Forcing FTP Servers with enabled anti-hammering ant brute-force modus ----------------------------------------------------------------------------- While playing around with Serv-U FTP Server, I found out that it is possible to bypass it's hammering protection which should protect accounts...