6079 matches found
CVE-2001-1550
CentraOne 5.2 and Centra ASP with basic authentication enabled creates world-writable base64 encoded log files, which allows local users to obtain cleartext passwords from decoded log files and impersonate users...
PT-2001-2581 · Thttpd · Thttpd
Name of the Vulnerable Software and Affected Versions: thttpd versions 1.95 through 2.20 Description: The issue is an off-by-one buffer overflow in Basic Authentication, allowing remote attackers to cause a denial of service and possibly execute arbitrary code. Recommendations: For versions 1.95...
PT-2001-2622 · Twig · Twig Webmail
Name of the Vulnerable Software and Affected Versions: TWIG webmail versions 2.7.4 and earlier Description: The default "basic" security setting in config.php for TWIG webmail stores cleartext usernames and passwords in cookies. This could allow attackers to obtain authentication information and...
Microsoft IIS/5 bogus Content-length bug.
Let's say that it's a bug, not a security flaw, but probably can lead into denial of service with some tweaking. When you send a bad request to Microsoft IIS/5.0 server it gives you the error and closes the connection, like when you fail to authenticate. Well... let's take a look to a normal...
McKesson Pathways Homecare 6.5 - Weak Username and Password Encryption
McKesson Pathways Homecare 6.5 - Weak Username and Password Encryption source: https://www.securityfocus.com/bid/3653/info McKesson Pathways Homecare is a client/server application which is used to track patient information, billing information and medical records for home care patients. The...
CVE-2001-1414
The Basic Security Module BSM for Solaris 2.5.1, 2.6, 7, and 8 does not log anonymous FTP access, which allows remote attackers to hide their activities, possibly when certain BSM audit files are not present under the FTP root...
CVE-1999-1372
CVE-1999-1372 concerns the deprecated Triactive Remote Manager with Basic authentication enabled, where credentials are stored in cleartext in registry keys. This storage flaw allows local users to gain privileges due to exposure of usernames and passwords and the local-privilege escalation risk ...
CVE-1999-1372: Undefined Security Weakness
Triactive Remote Manager with Basic authentication enabled stores the username and password in cleartext in registry keys, which could allow local users to gain privileges...
Linux news 4.12.00
Ядро 2.4.0-test12-pre4 Linus выпустил очередное pre ядро следующего тестового 2.4.0. В нем он добавил патчи от Alan'а Cox'a, включил патч от Stephen Tweedie, исправляющий ошибки в инодах и наложил еще несколько патчей от различных разработчиков ... Подробнее: http://www.kernel.org OpenBSD 2.8 is...
Linux news 1.11.00
Linux 2.2.18pre18 Alan Cox выпустил очередную pre-версию следующего стабильного ядра Linux: Linux 2.2.18pre18. Подробнее: http://linuxtoday.com/newsstory..php3?ltsn=2000-10-29-007-04-NW-KN Linux-2.4.0-test10-final Возможно последнее ядро в 2.4.0-test серии. Для релиза 2.4.0-stable ожидается...
CVE-2000-0788
The Mail Merge tool in Microsoft Word does not prompt the user before executing Visual Basic VBA scripts in an Access database, which could allow an attacker to execute arbitrary commands...
Уязвимость в Internet Explorer (Cached Web Credentials)
После вход на защищенную часть сайта IE запоминает имя и пароль пользователя, и может передать их при обращении к незащищенной части, что позволяет перехватить их при передаче, если используется основная basic авторизация...
CVE-2000-0597
Microsoft Office 2000 Excel and PowerPoint and PowerPoint 97 are marked as safe for scripting, which allows remote attackers to force Internet Explorer or some email clients to save files to arbitrary locations via the Visual Basic for Applications VBA SaveAs function, aka the "Office HTML Script...
Advisory CA-2000-16
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 CERT Advisory CA-2000-16 Microsoft 'IE Script'/Access/OBJECT Tag Vulnerability Original release date: August 11, 2000 Last revised: -- Source: CERT/CC A complete revision history is at the end of this file. Systems Affected Internet Explorer 4.x, 5.x...
CVE-2000-0649
CVE-2000-0649 describes an HTTP internal IP disclosure in IIS 4.0: an attacker can obtain the server’s private IP by requesting a page protected with Basic Authentication (no realm) via HTTP/1.0. Connected documents (Metasploit IIS_INTERNAL_IP module, Nessus/Nessus-like plugin, OpenVAS NASL) corr...
CVE-2000-0649: Exposure of Sensitive Information to an Unauthorized Actor
IIS 4.0 allows remote attackers to obtain the internal IP address of the server via an HTTP 1.0 request for a web page which is protected by basic authentication and has no realm defined...
CVE-2000-0649
IIS 4.0 allows remote attackers to obtain the internal IP address of the server via an HTTP 1.0 request for a web page which is protected by basic authentication and has no realm defined...
Microsoft IIS 2.0/3.0/4.0/5.0/5.1 - Internal IP Address Disclosure
source: https://www.securityfocus.com/bid/1499/info When a remote user attempts to access an area protected by basic authentication with no realm defined, while specifying HTTP 1.0, Microsoft IIS will return an Access Denied error message containing the internal IP address of the host. Even if II...
CVE-2000-0597
Microsoft Office 2000 Excel and PowerPoint and PowerPoint 97 are marked as safe for scripting, which allows remote attackers to force Internet Explorer or some email clients to save files to arbitrary locations via the Visual Basic for Applications VBA SaveAs function, aka the "Office HTML Script...