SHA could not escape my hands: clever use Cain crack MYSQL database password-bug warning-the black bar safety net

MYSQL database user password with the database user password the same, in the application of the system code are based on the plaintext appears in the access file read access can be directly from the database connection file is read, for example, asp code in conn. asp database connection file, in...

Research: Password 'secret question' woefully insecure

In research to be presented at the IEEE Symposium on Security and Privacy virginia.edu this week, researchers from Microsoft and Carnegie Mellon University plan to show that the secret questions used to secure the password-reset functions of a variety of websites are woefully insecure. In a study...

Sun Identity Manager shell characters vulnerability

Shell characteres vulnerability via password...

CVE-2008-6792

system-tools-backends before 2.6.0-1ubuntu1.1 in Ubuntu 8.10, as used by "Users and Groups" in GNOME System Tools, hashes account passwords with 3DES and consequently limits effective password lengths to eight characters, which makes it easier for context-dependent attackers to successfully condu...

Twitter needs a top-down security rethink

Twitter co-founder Biz Stone says the company “takes security very seriously” but the details behind the micro-blogging site’s recent hack shows that Twitter is light years away from having the most basic security controls in place. French hacker gains access to Twitter’s admin panel Here’s the...

CVE-2008-6193

CVE-2008-6193 affects Sam Crew MyBlog: passwords are stored in cleartext in a MySQL database, enabling potential access to sensitive information. The root cause is cleartext password storage. The connected documents do not provide patch versions or remediation steps. Exploitation details are not ...

CVE-2009-0013

CVE-2009-0013 affects Apple Mac OS X 10.4.11 and 10.5.6 where the dscl tool in DS Tools requires that passwords be provided as command line arguments. This allows local users to gain privileges by listing processes and extracting the password, enabling privilege escalation. The issue is part of A...

Konica/ Minolta Di 2010f n/a Default Password (deprecated)

Binary data 4866.prm...

CVE-2008-3857

The Base Service Utilities component in IBM DB2 9.1 before Fixpak 5 retains a cleartext password in memory after the database connection that sent the password is fully established, which might allow local users to obtain sensitive information by reading a memory dump...

CVE-2008-3840

The CVE-2008-3840 entry concerns Crafty Syntax Live Help (CSLH) 2.14.6 and earlier, where passwords are stored in cleartext in a MySQL database. The root cause is insecure password storage in plaintext, enabling an attacker with context access to obtain sensitive information from the database. Th...

CVE-2008-3067

sudo in SUSE openSUSE 10.3 does not clear the stdin buffer when password entry times out, which might allow local users to obtain a password by reading stdin from the parent process after a sudo child process exits...

CVE-2008-3067

CVE-2008-3067 affects sudo in SUSE/openSUSE 10.3 . The issue is that the process does not clear the standard input buffer when password entry times out, which could allow a local user to obtain the password by reading stdin from the parent process after the sudo child process exits. The provided ...

CVE-2008-1578

The CVE-2008-1578 item concerns Apple Mac OS X’s Single Sign-On sso_util tool. According to the provided sources, sso_util accepted passwords as command-line arguments, allowing local users to obtain sensitive credentials by listing processes. The vulnerability affects Mac OS X installations prio...

ikiwiki -- cleartext passwords

The ikiwiki development team reports: Until version 2.48, ikiwiki stored passwords in cleartext in the userdb. That risks exposing all users' passwords if the file is somehow exposed. To pre-emtively guard against that, current versions of ikiwiki store password hashes using Eksblowfish...

CVE-2008-1971

CVE-2008-1971 affects phShoutBox Final 1.5 and earlier. The vulnerability arises because authentication checks are performed only when a password is provided in $_POST, enabling remote attackers to elevate privileges by setting the phadmin cookie to admin.php (and, in 1.4 and earlier, the ssbadmi...

Design/Logic Flaw

WebCore, as used in Apple Safari before 3.1, does not properly mask the password field when reverse conversion is used with the Kotoeri input method, which allows physically proximate attackers to read the password...

Husrev Forums v2.0.1:PoWerBoard (tr) (id) Remote SQL Injection

---------------------------------------------------- Bulan: Cr@zyKing Thanks : CrackersChild & Eno7 & Pablin77 & Sys7ech & Brond Crew & X-Tech .Inc & TheBekir AYYILDIZ SWAT TIM : Hoo0? Google Dork : "Powered By Husrev" ---------------------------------------------------- Exploit:...

Mozilla Foundation Security Advisory 2008-04

Mozilla Foundation Security Advisory 2008-04 Title: Stored password corruption Impact: Moderate Announced: February 7, 2008 Reporter: Justin Dolske Products: Firefox Fixed in: Firefox 2.0.0.12 Description Mozilla developer Justin Dolske discovered that malicious sites, upon a user saving his or h...

Privileg escalation in Omegasoft Insel 7

Hi list, Omegasoft's Insel 7 stores Cookies on your computer for identifying the logged-in user. As these Cookies do not contain any password hash but only the username and some meaningless stuff you can easily get into the system with another login. this gets even more easy, as there is a...

DEBIAN-CVE-2007-6598

Dovecot before 1.0.10, with certain configuration options including use of %variables, does not properly maintain the LDAP+auth cache, which might allow remote authenticated users to login as a different user who has the same password...