964 matches found
CVE-2007-5626
makecatalogbackup in Bacula 2.2.5, and probably earlier, sends a MySQL password as a command line argument, and sometimes transmits cleartext e-mail containing this command line, which allows context-dependent attackers to obtain the password by listing the process and its arguments, or by sniffi...
CVE-2007-5626
makecatalogbackup in Bacula 2.2.5, and probably earlier, sends a MySQL password as a command line argument, and sometimes transmits cleartext e-mail containing this command line, which allows context-dependent attackers to obtain the password by listing the process and its arguments, or by sniffi...
DEBIAN-CVE-2007-5626
makecatalogbackup in Bacula 2.2.5, and probably earlier, sends a MySQL password as a command line argument, and sometimes transmits cleartext e-mail containing this command line, which allows context-dependent attackers to obtain the password by listing the process and its arguments, or by sniffi...
CVE-2007-5626
makecatalogbackup in Bacula 2.2.5, and probably earlier, sends a MySQL password as a command line argument, and sometimes transmits cleartext e-mail containing this command line, which allows context-dependent attackers to obtain the password by listing the process and its arguments, or by sniffi...
CVE-2007-5626
CVE-2007-5626 affects Bacula (noted as make_catalog_backup in 2.2.5 and likely earlier). The vulnerability arises because the MySQL password is passed on the command line and can be exposed by listing running processes or via cleartext emails when the script fails. Connected advisories confirm an...
Microsoft ActiveSync弱口令混淆信息泄露漏洞
BUGTRAQ ID: 25976 CVECAN ID: CVE-2007-5460 Microsoft ActiveSync是用于同步计算机与PDA的应用程序。 ActiveSync设备建立连接口令交换的过程实现上存在漏洞，攻击者可能利用此漏洞获取口令信息。 插入到USB口时设备会使用类似于标准网络接口的连接，获得IP地址后设备会通过RAPI在990/TCP端口初始化与主机的通讯，这个过程也会经历一个小型的握手例程，如果合适的话，会对主机挑战设备PIN或口令。用户提供了主机的PIN/口令后，会通过XOR与E9固定密钥进行混淆，然后通过USB网络连接发送给设备进行验证。...
CVE-2007-4961
The logintosimulator method in Linden Lab Second Life, as used by the secondlife:// protocol handler and possibly other Second Life login mechanisms, sends an MD5 hash in cleartext in the passwd field, which allows remote attackers to login to an account by sniffing the network and then sending...
CVE-2007-4961
The logintosimulator method in Linden Lab Second Life, as used by the secondlife:// protocol handler and possibly other Second Life login mechanisms, sends an MD5 hash in cleartext in the passwd field, which allows remote attackers to login to an account by sniffing the network and then sending...
CVE-2007-4961
The CVE-2007-4961 description documents an authentication flaw in Linden Lab Second Life: the login_to_simulator method (used by the secondlife:// protocol handler) transmits an MD5 hash in cleartext in the passwd field, enabling an attacker who can sniff network traffic to login to an account by...
CVE-2007-4150
The Visionsoft Audit on Demand Service VSAOD in Visionsoft Audit 12.4.0.0 uses weak cryptography XOR when 1 transmitting passwords, which allows remote attackers to obtain sensitive information by sniffing the network; and 2 storing passwords in the configuration file, which allows local users to...
CVE-2007-4160
The default configuration of TIBCO Rendezvous RV 7.5.2 clients, when -no-multicast is omitted, uses a multicast group as the destination for a network message, which might make it easier for remote attackers to capture message contents by sniffing the network...
Design/Logic Flaw
The Visionsoft Audit on Demand Service VSAOD in Visionsoft Audit 12.4.0.0 uses weak cryptography XOR when 1 transmitting passwords, which allows remote attackers to obtain sensitive information by sniffing the network; and 2 storing passwords in the configuration file, which allows local users to...
CVE-2007-4150
The CVE-2007-4150 issue affects Visionsoft Audit 12.4.0.0 (Visionsoft Audit) where weak cryptography (XOR) is used for passwords: during transmission over the network (passwords can be sniffed) and in the configuration file (local read access can reveal passwords). No further exploit details are ...
Default credentials
The Jedox Palo 1.5 client transmits the password in cleartext, which might allow remote attackers to obtain the password by sniffing the network, as demonstrated by starting Excel with the Palo plugin, opening a cube, and performing an Insert View...
CVE-2007-3581
The Jedox Palo 1.5 client transmits the password in cleartext, which might allow remote attackers to obtain the password by sniffing the network, as demonstrated by starting Excel with the Palo plugin, opening a cube, and performing an Insert View...
CVE-2007-3581
The CVE-2007-3581 entry concerns the Jedox Palo 1.5 client. Vulnerability: the client transmits the password in cleartext over the network, which could allow an attacker to obtain the password by sniffing traffic (as illustrated by the scenario with Excel and the Palo plugin). Impact: potential c...
CVE-2007-3581
The Jedox Palo 1.5 client transmits the password in cleartext, which might allow remote attackers to obtain the password by sniffing the network, as demonstrated by starting Excel with the Palo plugin, opening a cube, and performing an Insert View...
Design/Logic Flaw
Mail Notification 4.0, when WITHSSL is set to 0 at compile time, uses unencrypted connections for accounts configured with SSL/TLS, which allows remote attackers to obtain sensitive information by sniffing the network...
CVE-2007-3209
Mail Notification 4.0, when WITHSSL is set to 0 at compile time, uses unencrypted connections for accounts configured with SSL/TLS, which allows remote attackers to obtain sensitive information by sniffing the network...
CVE-2007-3209
Mail Notification 4.0, when WITHSSL is set to 0 at compile time, uses unencrypted connections for accounts configured with SSL/TLS, which allows remote attackers to obtain sensitive information by sniffing the network...