Gallery 1.4.3 and ealier user authentication bypass

A flaw exists in Gallery versions previous to 1.4.3-pl1 and post 1.2 which may give an attacker the potential to log in under the "admin" account. Data outside of the gallery is unaffected and the attacker cannot modify any data other than the photos or photo albums...

CitrusDB 0.3.6 - Remote Authentication Bypass

source: https://www.securityfocus.com/bid/12560/info CitrusDB is reportedly affected by an authentication bypass vulnerability. This issue is due to the application using a static value during the creation of user cookie information. An attacker could exploit this vulnerability to log in as any...

CitrusDB 0.3.6 - Remote Authentication Bypass

CitrusDB 0.3.6 - Remote Authentication Bypass source: https://www.securityfocus.com/bid/12560/info CitrusDB is reportedly affected by an authentication bypass vulnerability. This issue is due to the application using a static value during the creation of user cookie information. An attacker could...

XOOPS MyTextSanitizer CSS 1.3x & 2.x

Author: Doxical & Magistrat http://www.blocus-zone.com Date: 25/04/2003 Object: XOOPS MyTextSanitizer Filtering Bug Allows Remote Users to Conduct Cross-Site Scripting Attacks in many modules: News, newbb, private messages, signatures etc... Impact: Disclosure of authentication information,...

CVE-2003-0126

The web interface for SOHO Routefinder 550 firmware 4.63 and earlier, and possibly later versions, has a default "admin" account with a blank password, which could allow attackers on the LAN side to conduct unauthorized activities...

CVE-2003-0126

The web interface for SOHO Routefinder 550 firmware 4.63 and earlier, and possibly later versions, has a default "admin" account with a blank password, which could allow attackers on the LAN side to conduct unauthorized activities...

Ipswitch WhatsUp Gold Default Admin Account

This WhatsUp Gold server still has the default password for the admin user account. An attacker can use this account to probe other systems on the network and obtain sensitive information about the monitored systems. %NASLMINLEVEL 70300 Copyright 2001 by H D Moore See the Nessus Scripts License f...

SurgeFTP admin account bruteforcable

SurgeFTP admin account bruteforcable AFFECTED SYSTEMS SurgeFTP = 2.0f on a win32 platform, should give the same results on nix DESCRIPTION SurgeFTP uses the same extremely weak hashing algorithm as the NWauth module to store the admin password, but adding a fixed 'salting' value which is "qr"...

raq2.admin.exploit.txt

To replicate this bug you must have Site Administrator access to one of the accounts on the server. When you go into the Site Management for a site and select the User Management option, you get a list of the usernames that have been setup for that account. The green pencil edit icon is a command...