CVE-2006-6682

CVE-2006-6682 affects chetpasswd 2.3.3. The vulnerability arises from a discrepancy in error messages when authenticating with a valid username versus an invalid one, enabling remote attackers to enumerate valid usernames on the target system. The provided documents confirm the issue and its impa...

CVE-2002-2219

chetcpasswd.cgi in Pedro Lineu Orso chetcpasswd before 2.1 allows remote attackers to read the last line of the shadow file via a long user userid field...

CVE-2006-6680

CVE-2006-6680 affects chetcpasswd before 2.3.1. The issue arises from not documenting the need for 0400 permissions on /etc/chetcpasswd.allow, potentially permitting local users to read the file and obtain sensitive information. Evidence across sources (NVD/Red Hat entries) confirms the file path...

CVE-2002-2219

The CVE pertains to chetcpasswd.cgi in Pedro Lineu Orso chetcpasswd prior to version 2.1, where a flaw in the handling of a long user ID field enables remote disclosure of the last line of the /etc/shadow file. The vulnerability is an information disclosure via an unintended read of shadow data, ...

CVE-2006-6681

Pedro Lineu Orso chetcpasswd 2.3.3 does not have a rate limit for client requests, which might allow remote attackers to determine passwords via a dictionary attack...

CVE-2006-6683

CVE-2006-6683 affects the chetcpasswd utility (versions 2.4.1 and earlier). A custom component processes /etc/shadow and does not follow the PAM configuration, potentially allowing remote attackers to bypass PAM-enforced restrictions. The sources indicate this vulnerability but do not specify an ...

CVE-2006-6681

CVE-2006-6681: Pedro Lineu Orso chetcpasswd 2.3.3 is vulnerable because it does not implement a rate limit on client requests, potentially allowing remote attackers to perform dictionary attacks to guess passwords. The cited sources (NVD/NVD page) confirm the issue and its impact as a partial con...

CVE-2002-2221

The CVE-2002-2221 entry describes an untrusted search path vulnerability in chetcpasswd (Pedro Lineu Orso) versions 2.4.1 and earlier. The underlying issue is a modified PATH that can reference a malicious cp binary, enabling local users to gain privileges. Documented impact is local privilege es...

CVE-2006-5908

The CVE-2006-5908 entry describes multiple SQL injection vulnerabilities in the Yet Another News System (YANS) 0.2b, specifically in the login_user function within yans.func.php. The issue allows remote attackers to execute arbitrary SQL commands through the (1) username or (2) password parameter...

[SA12764] CubeCart "cat_id" SQL Injection Vulnerability

TITLE: CubeCart "catid" SQL Injection Vulnerability SECUNIA ADVISORY ID: SA12764 VERIFY ADVISORY: http://secunia.com/advisories/12764/ CRITICAL: Moderately critical IMPACT: Manipulation of data WHERE: From remote SOFTWARE: CubeCart 2.x http://secunia.com/product/4021/ DESCRIPTION: Pedro Sanches h...