CVE-2005-1647

Gurgens GASoft Guest Book 2.1 stores the db/Genid.dat database file under the web document root with insufficient access control, which allows remote attackers to obtain and decrypt usernames and passwords...

CVE-2005-0938

Ublog Reload 1.0 through 1.0.4 stores ublogreload.mdb under the web root, which allows remote attackers to read usernames and hashed passwords via a direct request to ublogreload.mdb...

CVE-2005-0422

DelphiTurk CodeBank aka KodBank 3.1 and earlier stores usernames and passwords in the Codebank registry key, which allows local users to gain privileges...

CVE-2002-1637

Multiple components in Oracle 9i Application Server 9iAS are installed with over 160 default usernames and passwords, including 1 SYS, 2 SYSTEM, 3 AQJAVA, 4 OWA, 5 IMAGEUSER, 6 USER1, 7 USER2, 8 PLSQL, 9 DEMO, 10 FINANCE, and many others, which allows attackers to gain privileges...

CVE-2002-1623

The CVE-2002-1623 entry concerns the Internet Key Exchange (IKE) protocol: when using Aggressive Mode for shared secret authentication, identities are not encrypted during negotiation. This can allow remote attackers to determine valid usernames by monitoring responses before password entry or by...

CVE-2002-1623

The design of the Internet Key Exchange IKE protocol, when using Aggressive Mode for shared secret authentication, does not encrypt initiator or responder identities during negotiation, which may allow remote attackers to determine valid usernames by 1 monitoring responses before the password is...

CVE-2004-1694

Symantec ON Command CCM 5.4.x and iCommand 3.0.x has four default usernames and passwords, one of which is hardcoded, which allows remote attackers to gain unauthorized access...

CVE-2004-1609

SalesLogix 6.1 is affected by CVE-2004-1609, where usernames, passwords, and other sensitive data are sent in HTTP response headers. The underlying issue exposes partial confidentiality and could let remote attackers gain access. The CVSS v2 base score is 5.0 (MEDIUM) with network attack vector a...

CVE-2004-1697

The CVE-2004-1697 issue affects CA Unicenter Management Portal versions 2.0 and 3.1, where the Forgot your Password link reveals different error messages for existing vs non-existing usernames, enabling remote username guessing. Underlying cause is information disclosure through authentication er...

CVE-2004-1602

ProFTPD 1.2.x, including 1.2.8 and 1.2.10, responds in a different amount of time when a given username exists, which allows remote attackers to identify valid usernames by timing the server response...

CVE-2004-1428

ArGoSoft FTP before 1.4.2.1 generates an error message if the user name does not exist instead of prompting for a password, which allows remote attackers to determine valid usernames...

PerlDesk 1.x - SQL Injection

PerlDesk 1.x - SQL Injection !/usr/bin/perl Example: kb.cgi?view=0 UNION SELECT 1,3,password,username,3,7 FROM users Exploit is attached. ./pde.pl www.internethosting4u.com /perldesk/kb.cgi 148.244.150.58:80 use IO::Socket; print ' PerlDesk exploit Usage: ./pdsploit.pl host path proxy Vunerabilit...

PerlDesk 1.x - SQL Injection

!/usr/bin/perl Example: kb.cgi?view=0 UNION SELECT 1,3,password,username,3,7 FROM users Exploit is attached. ./pde.pl www.internethosting4u.com /perldesk/kb.cgi 148.244.150.58:80 use IO::Socket; print ' PerlDesk exploit Usage: ./pdsploit.pl host path proxy Vunerability discovered by deluxe89 and...

[SA13843] Squid Username Whitespace Security Bypass Issue

TITLE: Squid Username Whitespace Security Bypass Issue SECUNIA ADVISORY ID: SA13843 VERIFY ADVISORY: http://secunia.com/advisories/13843/ CRITICAL: Less critical IMPACT: Security Bypass WHERE: From local network SOFTWARE: Squid 2.x http://secunia.com/product/310/ DESCRIPTION: A security issue has...

CVE-2005-0121

Multiple buffer overflows in golddig 2.0 and earlier allow local users to execute arbitrary code via 1 a long map name command line argument or 2 a long username as recorded in the USER environment variable...

ITA Forum <= 1.49 SQL Injection Exploit

Exploit for unknown platform in category web applications ======================================= ITA Forum = 1.49 SQL Injection Exploit ======================================= !/usr/bin/perl use LWP::UserAgent; ITA Forum 1.49 sql injection exploit with one char bruteforce by 1dt.w0lf // r57...

ArGoSoft FTP Server reveals valid usernames and allows for brute force attacks

Vendor: ArGoSoft Date: December 31, 2004 Issue: ArGoSoft FTP Server reveals valid usernames and allows for brute force attacks URL: http://www.argosoft.com/ftpserver/ Advisory: http://www.lovebug.org/argosoftadvisory.txt Program Overview: ArGoSoft FTP Server is a lightweight FTP Server for...

CVE-2004-2419

Keene Digital Media Server 1.0.2 allows local users to obtain usernames and passwords by reading the dmscore.db file on the local system...

ProFTPD Login Timing Account Name Enumeration

The remote ProFTPd server is as old or older than 1.2.10 It is possible to determine which user names are valid on the remote host based on timing analysis attack of the login procedure. An attacker may use this flaw to set up a list of valid usernames for a more efficient brute-force attack...

CVE-2004-1694

Symantec ON Command CCM 5.4.x and iCommand 3.0.x has four default usernames and passwords, one of which is hardcoded, which allows remote attackers to gain unauthorized access...