3112 matches found
CVE-2005-3414
CVE-2005-3414 affects eyeOS 0.8.4. The issue arises from storing usrinfo.xml in the web document root with insufficient access control, allowing remote attackers to obtain user credentials. The available connected documents confirm eyeOS 0.8.4 and the credential exposure risk, but do not provide ...
[SA17105] eyeOS Script Insertion and Exposure of User Credentials
TITLE: eyeOS Script Insertion and Exposure of User Credentials SECUNIA ADVISORY ID: SA17105 VERIFY ADVISORY: http://secunia.com/advisories/17105/ CRITICAL: Less critical IMPACT: Cross Site Scripting, Exposure of sensitive information WHERE: From remote SOFTWARE: eyeOS 0.x...
CVE-2005-2962
The post-installation script for ntlmaps before 0.9.9 sets world-readable permissions for the configuration file, which allows local users to obtain the username and password...
Malicious setRequestHeader cross-site vulnerability
A malicious setRequestHeader can be used to stealuser credentials and inject cross-site JavaScript...
PHP-Fusion 6.00.109 - 'msg_send' SQL Injection
SQL Injection, poc: http://target/pathtoPhpFusion/messages.php?msgsend=' UNION SELECT userpassword FROM fusionusers WHERE username='adminusername'/ inserted the above for a better description /str0ke 19.17 28/09/2005 -- PhpF600109xpl.php PHP-Fusion v6.00.109 SQL Injection / admin|users credential...
PHP-Fusion 6.00.109 (msg_send) SQL Injection Exploit
Exploit for unknown platform in category web applications ==================================================== PHP-Fusion 6.00.109 msgsend SQL Injection Exploit ==================================================== SQL Injection, poc: http://target/pathtoPhpFusion/messages.php?msgsend=' UNION SELE...
PHP Advanced Transfer Manager <= 1.30 Multiple Vulnerabilities
Binary data 3234.prm...
Security Flaw in pam_per_user Module
Summary/Impact: --------------- There is a security flaw in the pamperuser PAM module that can allow someone to authenticate as any user on the system, provided that they already have the proper credentials for one account. This security hole is fixed in pamperuser-0.4, which is available from:...
CVE-2005-2859
Savant Web Server stores user credentials in plaintext in the Savant\Users registry key, which allows local users to gain privileges...
CVE-2005-2859
Savant Web Server stores user credentials in plaintext in the Savant\Users registry key, which allows local users to gain privileges...
CVE-2005-2859
Savant Web Server stores user credentials in plaintext in the Savant\Users registry key, enabling local privilege escalation. Affected component: Savant Web Server; root cause: plaintext credential storage leading to unauthorized access. CVSS2 shows LOCAL attack with low complexity; base impact i...
phorum5x.txt
======================================================================================= XOR Crew :: Security Advisory 9/1/2005 ======================================================================================= Phorum 5.x Multiple XSS and Session Hijacking Vulnerabilities...
Microsoft Windows keyboard events design flow
Application with diferent user's credentials may send keyboard events to applications running in the same desktop emulating user input...
Flatnuke 2.5.6 (possibly prior versions) Underlying system information disclosure / Administrative & users credentials disclosure
Flatnuke 2.5.6 Underlying system information disclosure / Administrative & users credentials disclosure / cross site scripting / path disclosure / resource consumption poc tested on Windows software: site: http://flatnuke.sourceforge.net/flatnuke/ 1 cross site scripting:...
flatnuke256.txt
Flatnuke 2.5.6 Underlying system information disclosure / Administrative & users credentials disclosure / cross site scripting / path disclosure / resource consumption poc tested on Windows software: site: http://flatnuke.sourceforge.net/flatnuke/ 1 cross site scripting:...
SqWebMail 5.0.4 - HTML Email IMG Tag Script Injection
SqWebMail 5.0.4 - HTML Email IMG Tag Script Injection source: https://www.securityfocus.com/bid/14676/info SqWebMail is affected by a vulnerability that may allow remote attackers to inject and execute arbitrary script code in a user's browser. This may allow for various attacks including session...
SqWebMail 5.0.4 - HTML Email IMG Tag Script Injection
source: https://www.securityfocus.com/bid/14676/info SqWebMail is affected by a vulnerability that may allow remote attackers to inject and execute arbitrary script code in a user's browser. This may allow for various attacks including session hijacking due to the theft of user credentials...
Simple PHP Blog File Upload and User Credentials Exposure Vulnerabilities
=============================================================================== XOR Crew :: Security Advisory 8/25/2005 =============================================================================== Simple PHP Blog File Upload and User Credentials Exposure Vulnerabilities...
Open Bulletin Board 1.0.5 - SQL Injection
!/usr/bin/perl -w OpenBB sql injection tested on Open Bulletin Board 1.0.5 with mysql coded by x97Rang 2005 RST/GHC Gr33tz: blf, 1dt.w0lf use IO::Socket; if @ARGV != 3 print "\nUsage: $0 server path id\n"; print "like $0 forum.mysite.com / 1\n"; print "If found nothing - forum NOT vulnerable\n\n"...
BlogTorrent <= 0.92 Remote Password Disclosure Exploit
No description provided by source. Edited for easy info. /str0ke Software: BlogTorrent 0.92 = Vendor: http://www.blogtorrent.com/ Author: LazyCrs && pjphem Date: 10/07/2005 Type: Remote/Local User Password Disclosure 0x03 - POC http://test/pathofblog/data/newusers =...