CVE-2009-1384

pamkrb5 2.2.14 through 2.3.4, as used in Red Hat Enterprise Linux RHEL 5, generates different password prompts depending on whether the user account exists, which allows remote attackers to enumerate valid usernames...

CVE-2009-1803

FreePBX 2.5.1, and other 2.4.x, 2.5.x, and pre-release 2.6.x versions, generates different error messages for a failed login attempt depending on whether the user account exists, which allows remote attackers to enumerate valid usernames...

CVE-2009-1803

FreePBX 2.5.1, and other 2.4.x, 2.5.x, and pre-release 2.6.x versions, generates different error messages for a failed login attempt depending on whether the user account exists, which allows remote attackers to enumerate valid usernames...

CVE-2009-1769

The web interface in Open Computer and Software Inventory Next Generation OCS Inventory NG 1.01 generates different error messages depending on whether a username is valid, which allows remote attackers to enumerate valid usernames...

CVE-2008-6797

The server in Mitel NuPoint Messenger R11 and R3 sends usernames and passwords in cleartext to Exchange servers, which allows remote attackers to obtain sensitive information by sniffing the network...

NuPoint Messenger server transmits authentication credentials in plain text

Overview NuPoint Messenger is a unified communications product that connects to a Microsoft Exchange server. When communicating with the mail server, the NuPoint Messenger server transmits Exchange usernames and passwords in cleartext. Description The NuPoint Messenger server can connect to a...

Dream FTP Server 1.02 (users.dat) Arbitrary File Disclosure Exploit

Exploit for windows platform in category remote exploits =================================================================== Dream FTP Server 1.02 users.dat Arbitrary File Disclosure Exploit =================================================================== !/usr/bin/perl -w This Bug Similar to...

Mandriva Linux Security Advisory : pam (MDVSA-2009:077)

A security vulnerability has been identified and fixed in pam : Integer signedness error in the pamStrTok function in libpam/pammisc.c in Linux-PAM aka pam 1.0.3 and earlier, when a configuration file contains non-ASCII usernames, might allow remote attackers to cause a denial of service, and mig...

Code injection

The web login functionality c/portal/login in Novell Teaming 1.0 through SP3 1.0.3 generates different error messages depending on whether the username is valid or invalid, which makes it easier for remote attackers to enumerate usernames...

Mandriva Update for samba MDKA-2007:001 (samba)

Check for the Version of samba OpenVAS Vulnerability Test Mandriva Update for samba MDKA-2007:001 samba Authors: System Generated Check Copyright: Copyright c 2009 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under the...

Joomla Component com_bookjoomlas SQL Injection Vulnerability

Salvatore "drosophila" Fresta + Application: Joomla Component combookjoomlas + Version: 0.1 + Website: http://www.alikonweb.it + Bugs: A SQL Injection + Exploitation: Remote + Dork: inurl:"index.php?option=combookjoomlas" + Date: 06 Apr 2009 + Discovered by: Salvatore "drosophila" Fresta + Author...

Mandrake Security Advisory MDVSA-2009:077 (pam)

The remote host is missing an update to pam announced via advisory MDVSA-2009:077. OpenVAS Vulnerability Test $Id: mdksa2009077.nasl 6573 2017-07-06 13:10:50Z cfischer $ Description: Auto-generated from advisory MDVSA-2009:077 pam Authors: Thomas Reinke Copyright: Copyright c 2009 E-Soft Inc...

CVE-2009-1076

Sun Java System Identity Manager IdM 7.0 through 8.0 responds differently to failed use of the end-user question-based login feature depending on whether the user account exists, which allows remote attackers to enumerate valid usernames...

DeluxeBB <= 1.3 (qorder) Remote SQL Injection Vulnerability

No description provided by source. Author: girex Homepage: girex.altervista.org Date: 18/03/2009 CMS: DeluxeBB 1.3 and prior site: deluxebb.com NOTE: - Works regardless of php.ini settings - This SQL injection will shows you username and md5 of ALL registered users of the site. - This PoC was...

CVE-2009-0887

Integer signedness error in the pamStrTok function in libpam/pammisc.c in Linux-PAM aka pam 1.0.3 and earlier, when a configuration file contains non-ASCII usernames, might allow remote attackers to cause a denial of service, and might allow remote authenticated users to obtain login access with ...

CVE-2009-0887

Integer signedness error in the pamStrTok function in libpam/pammisc.c in Linux-PAM aka pam 1.0.3 and earlier, when a configuration file contains non-ASCII usernames, might allow remote attackers to cause a denial of service, and might allow remote authenticated users to obtain login access with ...

RedHat Update for vsftpd RHSA-2008:0680-01

Check for the Version of vsftpd OpenVAS Vulnerability Test RedHat Update for vsftpd RHSA-2008:0680-01 Authors: System Generated Check Copyright: Copyright c 2009 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under the ter...

CVE-2009-0616

Cisco Application Networking Manager ANM before 2.0 uses default usernames and passwords, which makes it easier for remote attackers to access the application, or cause a denial of service via configuration changes, related to "default user credentials during installation."...

Design/Logic Flaw

Cisco ACE Application Control Engine Module for Catalyst 6500 Switches and 7600 Routers before A21.1 uses default 1 usernames and 2 passwords for a the administrator and b web management, which makes it easier for remote attackers to perform configuration changes or obtain operating-system access...

CVE-2009-0616

Cisco Application Networking Manager ANM before 2.0 uses default usernames and passwords, which makes it easier for remote attackers to access the application, or cause a denial of service via configuration changes, related to "default user credentials during installation."...