PT-2011-3800

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 13.0.782.107 Description The issue is related to the Basic Authentication dialog implementation in Google Chrome, which does not properly handle strings. This could make it easier for remote attackers to capture...

Design/Logic Flaw

Unspecified vulnerability in HP Service Manager 7.02, 7.11, 9.20, and 9.21 and Service Center 6.2.8 allows remote attackers to capture HTTP session credentials via unknown vectors...

CVE-2011-1860

CVE-2011-1860 affects HP Service Manager (versions 7.02, 7.11, 9.20, 9.21) and HP Service Center 6.2.8. The vulnerability enables remote attackers to capture HTTP session credentials, via unspecified vectors, with a CVSSv2 base score of 5.0 (Network, Low complexity, no authentication, partial con...

CVE-2011-1860: Undefined Security Weakness

Unspecified vulnerability in HP Service Manager 7.02, 7.11, 9.20, and 9.21 and Service Center 6.2.8 allows remote attackers to capture HTTP session credentials via unknown vectors...

CVE-2011-0160: Improper Input Validation

WebKit, as used in Apple Safari before 5.0.4 and iOS before 4.3, does not properly handle redirects in conjunction with HTTP Basic Authentication, which might allow remote web servers to capture credentials by logging the Authorization HTTP header...

PT-2011-2142

Name of the Vulnerable Software and Affected Versions Apple Safari versions prior to 5.0.4 iOS versions prior to 4.3 Description The issue arises from improper handling of redirects in conjunction with HTTP Basic Authentication. This might allow remote web servers to capture credentials by loggin...

CVE-2010-0172: Undefined Security Weakness

toolkit/components/passwordmgr/src/nsLoginManagerPrompter.js in the asynchronous Authorization Prompt implementation in Mozilla Firefox 3.6 before 3.6.2 does not properly handle concurrent authorization requests from multiple web sites, which might allow remote web servers to spoof an authorizati...

CVE-2009-0612

CVE-2009-0612 affects Trend Micro InterScan Web Security Virtual Appliance (IWSVA) 3.x and InterScan Web Security Suite (IWSS) 3.x. When basic authorization is enabled on the standalone proxy, the product forwards the Proxy-Authorization header from Windows Media Player, enabling remote web serve...

Authentication Capture: Telnet

This module provides a fake Telnet service that is designed to capture authentication credentials. DONTs and WONTs are sent to the client for all option negotiations, except for ECHO at the time of the password prompt since the server controls that for a bit more realism. This module requires...

Authentication Capture: POP3

This module provides a fake POP3 service that is designed to capture authentication credentials. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Authentication Capture: POP3', 'Description' = %...

HTTP auth prompt tab spoofing — Mozilla

The HTTP authentication prompt appears above the currently open tab regardless of which tab triggered it. A spoofer who could get a user to open a high value target in another tab might be able to capture the user's ID and password. HTTP auth dialogs are visually distinct from the web form logins...