Kerberos 4 4.0/5 5.0 - KDC Spoofing

source: https://www.securityfocus.com/bid/1616/info Kerberos is a cryptographic authentication protocol that allows users of a network to access services without transmitting cleartext passwords. A common implementation of the protocol includes a login service which is vulnerable to an attack whi...

Darxite daemon remote exploit/DoS problem

Darxite daemon remote exploit/DoS problem + Advisory by dethy www.synnergy.net |=============================================| Vulnerable: Darxite All versions up to and including 0.4 Discovery : [email protected] Exploits : Scrippie & dethy Description ----------- "Darxite" is a daemon, written...

PHP-Nuke 1.0/2.5 - Administrative Privileges

source: https://www.securityfocus.com/bid/1592/info PHP-Nuke is a website creation/maintainence tool written in PHP3. It is possible to elevate priviliges in this system from normal user to administrator due to a flaw in authentication code. The problem occurs here: $aid = variable holding author...

VIGILANTE-2000005.txt

Watchguard Firebox Authentication DoS Advisory Code: VIGILANTE-2000005 Release Date: August 15, 2000 Systems Affected: Tested on the newest version of the Watchguard Firebox II that was on the 22nd of June, but it is very likely that this bug exists in all prior versions that include the...

Sun AnswerBook2 1.4.21.4.31.4.4 - Administration Interface Access

Sun AnswerBook2 1.4.21.4.31.4.4 - Administration Interface Access source: https://www.securityfocus.com/bid/1554/info A lack of authentication checks for certain scripts within the administration interface of AnswerBook2 versions 1.4.2 and prior, for Solaris, allows remote users to create...

ipop2d fold Command Arbitrary File Access

The remote pop2 server allows the reading of arbitrary files for authenticated users, using the 'fold' command. C Tenable Network Security, Inc. Theory : - log into the remote server - fold /etc/passwd - read 1 - retr We only check the banner for this flaw include"compat.inc"; ifdescription...

CVE-2000-0673

The NetBIOS Name Server NBNS protocol does not perform authentication, which allows remote attackers to cause a denial of service by sending a spoofed Name Conflict or Name Release datagram, aka the "NetBIOS Name Server Protocol Spoofing" vulnerability...

Blackboard Courseinfo v4.0 User Authentication

Apparently Courseinfo or at least the implementation I was playing with has no user authentication, meaning that anyone can force feed their own form values and Perl with merrily modify the database. So for instance running: all form input is in caps for readability...

netscape.ad.00-07

July 11, 2000 Security Advisory netscape.ad.00-07 : Netscape Administration Server Password Disclosure. Affected Platforms: AIX Digital-Unix HP-Unix IRIX Linux Solaris WindowsNT Affected Versions: Netscape SuiteSpot running on: Netscape Enterprise/3.5.1C Netscape Enterprise/3.5.1G Netscape...

CVE-2000-0651

The ClientTrust program in Novell BorderManager does not properly verify the origin of authentication requests, which could allow remote attackers to impersonate another user by replaying the authentication requests and responses from port 3024 of the victim's machine...

CVE-2000-0377

The Remote Registry server in Windows NT 4.0 allows local authenticated users to cause a denial of service via a malformed request, which causes the winlogon process to fail, aka the "Remote Registry Access Authentication" vulnerability...

CVE-2000-0551

The file transfer mechanism in Danware NetOp 6.0 does not provide authentication, which allows remote attackers to access and modify arbitrary files...

sses-sshauth.txt

Sword & Shield Enterprise Security, Inc. - Security Advisory www.sses.net, Copyright c 2000 Advisory: Secure Shell Authentication Vulnerability Release Date: May 10, 2000 Application: sshd Severity: High - A user local or remote can log into any account with a valid login shell. Status: Affected...

Buffer Overflow in version .14

IC Radius version .14, and possibly earlier versions, contain a buffer overflow that occurs when trying to authenticate with a valid username longer than 24 characters. The culprit is in mysql.c, in the function sqlgetvpdata. This function is normally run 4 times during authentication. The second...

Symantec pcAnywhere 9.0 - Weak Encryption

// source: https://www.securityfocus.com/bid/1093/info Symantec pcAnywhere is shipped by default with a weak encryption scheme that is used to encrypt username and password transmittal. Therefore, usernames and password can be retrieved by anyone sniffing the network in between the host computer...

CVE-2000-0191

Axis StorPoint CD allows remote attackers to access administrator URLs without authentication via a .. dot dot attack...

CVE-2000-0142

The authentication protocol in Timbuktu Pro 2.0b650 allows remote attackers to cause a denial of service via connections to port 407 and 1417...

CVE-2000-0058

Network HotSync program in Handspring Visor does not have authentication, which allows remote attackers to retrieve email and files...

CVE-1999-0692

The default configuration of the Array Services daemon arrayd disables authentication, allowing remote users to gain root privileges...

SCO Unixware 7.1 - i2odialogd Remote Buffer Overflow

SCO Unixware 7.1 - i2odialogd Remote Buffer Overflow // source: https://www.securityfocus.com/bid/876/info UnixWare is a variant of the Unix operating system originally written by SCO, and distributed and maintained by Caldera. i20dialogd is a daemon which provides a front-end for controlling the...