NETGEAR WNR1000v3 Password Disclosure Vulnerability

Newer firmware versions of the Netgear N150 WNR1000v3 wireless router are affected by a password recovery vulnerability. Exploiting this vulnerability allows an attacker to recover the router SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced...

Opolis.eu Secure Mail Blind SQL Injection / XSS / CSRF / DoS

Opolis.eu suffers from cross site request forgery, cross site scripting, denial of service, and remote blind SQL injection vulnerabilities. The vendor has not responded to the researchers reports of these issues...

Cisco ISE Captive Portal Application Plaintext Credentials Exposure Vulnerability

A vulnerability in the captive portal application of Cisco Identity Services Engine ISE could allow an unauthenticated, remote attacker or local, authenticated attacker to potentially gain access to the username and password of an authenticated session. The vulnerability is due to improper use of...

Apple Xsan Admin出错消息信息泄露漏洞

BUGTRAQ ID: 36385 CVECAN ID: CVE-2009-2201 Xsan是一个企业级的存储网络解决方案，Xsan Admin是用于简化SAN管理的应用。 通过Xsan Admin进行屏幕共享可能会提供包含有用户名和口令的出错对话框，能够查看用户显示的攻击者可以读取明文的用户凭据。 Apple Xsan 2.1.1 厂商补丁： Apple ----- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： http://www.apple.com/support/downloads/...

atmail541-download.txt

@Mail PHP Version 5.41 patch Release http://atmail.com/demo/atmailphpdemo.tgz The default install of Atmail 5.41 creates the following file in the atmail/ directory: build-plesk-upgrade.php If that file is called via http, such as: http://example.com/atmail/build-plesk-upgrade.php it will execute...

CVE-2003-1476

CVE-2003-1476 affects Cerberus FTP Server 2.1. The provided documents describe a plaintext storage of usernames and passwords, which could allow local users to gain access. This disclosure aligns with a local-privilege concern but the connected sources do not provide explicit exploit vectors, imp...

CVE-2007-1137

putmail.py in Putmail before 1.4 does not detect when a user attempts to use TLS with a server that does not support it, which causes putmail.py to send the username and password in plaintext while the user believes encryption is in use, and allows remote attackers to obtain sensitive information...

CVE-2007-1191

The Social Bookmarks del.icio.us plug-in 8F in Quicksilver writes usernames and passwords in plaintext to the /Library/Logs/Console/UID/Console.log file, which allows local users to obtain sensitive information by reading this file...

CVE-2007-1191

The Social Bookmarks del.icio.us plug-in 8F in Quicksilver writes usernames and passwords in plaintext to the /Library/Logs/Console/UID/Console.log file, which allows local users to obtain sensitive information by reading this file...

CVE-2006-5956

XLineSoft PHPRunner 3.1 stores the 1 database server name, 2 database names, 3 usernames, and 4 passwords in plaintext in %WINDIR%\PHPRunner.ini, which allows local users to obtain sensitive information by reading the file...

CVE-2004-2524

clogin.php in Benchmark Designs' WHM AutoPilot 2.4.5 and earlier allows remote attackers to obtain plaintext username and password credentials by using the clogine and base64encode functions to encode the desired user ID in the c parameter, then read the plaintext values in the resulting form...

CVE-2004-2524

CVE-2004-2524 affects Benchmark Designs’ WHM AutoPilot 2.4.5 and earlier. The vulnerability arises when clogin.php uses clogin_e and base64_encode to encode the target user ID in the c parameter, allowing remote attackers to read plaintext usernames and passwords from the resulting form. The desc...

CVE-2004-2400

Summary: CVE-2004-2400 affects WinFTP Server 1.6. The vulnerability arises because credentials (username and password) are stored in plaintext in the file data\user.wfd, allowing local users to obtain credentials. The NVD reports a low base score (2.1) with LOCAL attack vector and PARTIAL confide...

CVE-2004-2400

WinFTP Server 1.6 stores username and password credentials in plaintext in the data\user.wfd file, which allows local users to gain access to the credentials...

CVE-2005-2395

Affected software: Mozilla Firefox 1.0.4 and 1.0.5. Vulnerability type / cause: Firefox may not select the strongest available HTTP authentication challenge as required by RFC2617, potentially causing credentials to be sent in plaintext even when an encrypted channel exists. Impact (as stated): c...

CVE-2005-1092

Lightspeed DeluxeFTP 6.01 stores usernames and passwords in plaintext in sites.xml, which is world-readable, which allows local users to gain privileges...

CVE-2005-1092

Lightspeed DeluxeFTP 6.01 stores usernames and passwords in plaintext in sites.xml, which is world-readable. This allows local users to access credentials and potentially gain privileges. No explicit exploit details or fixed version are provided in the connected documents; remediation is not spec...

CVE-2005-1094

CVE-2005-1094 affects FTP Now 2.6.14, where usernames and passwords are stored in plaintext in sites.xml and are world-readable. This constitutes a local privilege escalation risk for any local user able to read that file. The description does not provide exploit details, affected versions beyond...

CVE-2005-0604

lnss.exe in GFI Languard Network Security Scanner 5.0 stores the username and password in memory in plaintext, which could allow local administrators to obtain domain administrator credentials...

CVE-2004-1171

KDE 3.2.x and 3.3.0 through 3.3.2, when saving credentials that are 1 manually entered by the user or 2 created by the SMB protocol handler, stores those credentials for plaintext in the user's .desktop file, which may be created with world-readable permissions, which could allow local users to...