Microsoft ISA Server 2006 Radius OTP Bypass (MS09-031; CVE-2009-1135)

ISA Server, originating as Microsoft Proxy Server, is a Firewall & Security product that provides Application-Layer Firewalling, acts as a VPN endpoint, and provides Internet Access for client systems in a Business Networking environment. An elevation of privilege vulnerability exists in Microsof...

MS09-031: Vulnerability in Microsoft ISA Server 2006 Could Cause Elevation of Privilege (970953)

The version of Microsoft Internet Security and Acceleration ISA Server 2006 installed on the remote host may allow an unauthenticated attacker with knowledge of administrator account usernames to gain access to published resources in the context of such a user without having to authenticate with...

OpenOffice Writer DoS

Crash on .otp files parocessing...

Design/Logic Flaw

OpenSSH, when using OPIE One-Time Passwords in Everything for PAM, allows remote attackers to determine the existence of certain user accounts, which displays a different response if the user account exists and is configured to use one-time passwords OTP, a similar issue to CVE-2007-2243...

CVE-2007-2768

OpenSSH, when using OPIE One-Time Passwords in Everything for PAM, allows remote attackers to determine the existence of certain user accounts, which displays a different response if the user account exists and is configured to use one-time passwords OTP, a similar issue to CVE-2007-2243...

CVE-2007-2768

OpenSSH, when using OPIE (One-Time Passwords in Everything) for PAM, can leak whether a target user exists by returning different responses if the account is configured for OTP. This is described for CVE-2007-2768 (OpenSSH 4.6 and earlier) and is related to CVE-2007-2243 in the IBM bulletin, whic...

Digipass Go3 Token Dumper (at least for 2006)

The initial reverse engineering of Vasco’s Digipass Go3 algorithm follows in C++. I think this implementation is a "rough" approximation, if we take some limitations about 2006 and the calculations made into account. Or I'm just joking… : This generator was able to predict an "otp" collision,...

CVE-2001-1463

The remote administration client for RhinoSoft Serv-U 3.0 sends the user password in plaintext even when S/KEY One-Time Password OTP authentication is enabled, which allows remote attackers to sniff passwords...