1058 matches found
CXF: UsernameTokens are sent in plaintext with a Symmetric EncryptBeforeSigning policy
It was discovered that UsernameTokens were sent in plain text by an Apache CXF client that used a Symmetric EncryptBeforeSigning password policy. A man-in-the-middle attacker could use this flaw to obtain the user name and password used by the client application using Apache CXF...
CVE-2013-6806
OpenText Exceed OnDemand EoD 8 allows man-in-the-middle attackers to disable bidirectional authentication and obtain sensitive information via a crafted string in a response, which triggers a downgrade to simple authentication that sends credentials in plaintext...
CVE-2013-6806
The CVE-2013-6806 entry concerns OpenText Exceed OnDemand (EoD) 8. A crafted response string allows a man-in-the-middle to disable bidirectional authentication, triggering a downgrade to simple authentication and sending credentials in plaintext. The vulnerability is network-exploitable with medi...
CommonSpot < 7.0.2 / 8.0.3 / 9.0.0 Multiple Vulnerabilities
According to its version number, the CommonSpot install hosted on the remote web server is affected by multiple vulnerabilities : - An access restriction bypass via a direct request. CVE-2014-2859 - Multiple cross-site scripting XSS vulnerabilities. CVE-2014-2860, CVE-2014-2861 - Improper...
NETGEAR WNR1000v3 Password Disclosure Vulnerability
Newer firmware versions of the Netgear N150 WNR1000v3 wireless router are affected by a password recovery vulnerability. Exploiting this vulnerability allows an attacker to recover the router SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced...
Opolis.eu Secure Mail Blind SQL Injection / XSS / CSRF / DoS
Opolis.eu suffers from cross site request forgery, cross site scripting, denial of service, and remote blind SQL injection vulnerabilities. The vendor has not responded to the researchers reports of these issues...
Cisco ISE Captive Portal Application Plaintext Credentials Exposure Vulnerability
A vulnerability in the captive portal application of Cisco Identity Services Engine ISE could allow an unauthenticated, remote attacker or local, authenticated attacker to potentially gain access to the username and password of an authenticated session. The vulnerability is due to improper use of...
Apple Xsan Admin出错消息信息泄露漏洞
BUGTRAQ ID: 36385 CVECAN ID: CVE-2009-2201 Xsan是一个企业级的存储网络解决方案，Xsan Admin是用于简化SAN管理的应用。 通过Xsan Admin进行屏幕共享可能会提供包含有用户名和口令的出错对话框，能够查看用户显示的攻击者可以读取明文的用户凭据。 Apple Xsan 2.1.1 厂商补丁： Apple ----- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： http://www.apple.com/support/downloads/...
atmail541-download.txt
@Mail PHP Version 5.41 patch Release http://atmail.com/demo/atmailphpdemo.tgz The default install of Atmail 5.41 creates the following file in the atmail/ directory: build-plesk-upgrade.php If that file is called via http, such as: http://example.com/atmail/build-plesk-upgrade.php it will execute...
CVE-2003-1476
CVE-2003-1476 affects Cerberus FTP Server 2.1. The provided documents describe a plaintext storage of usernames and passwords, which could allow local users to gain access. This disclosure aligns with a local-privilege concern but the connected sources do not provide explicit exploit vectors, imp...
CVE-2007-1137
putmail.py in Putmail before 1.4 does not detect when a user attempts to use TLS with a server that does not support it, which causes putmail.py to send the username and password in plaintext while the user believes encryption is in use, and allows remote attackers to obtain sensitive information...
CVE-2007-1191
The Social Bookmarks del.icio.us plug-in 8F in Quicksilver writes usernames and passwords in plaintext to the /Library/Logs/Console/UID/Console.log file, which allows local users to obtain sensitive information by reading this file...
CVE-2007-1191
The Social Bookmarks del.icio.us plug-in 8F in Quicksilver writes usernames and passwords in plaintext to the /Library/Logs/Console/UID/Console.log file, which allows local users to obtain sensitive information by reading this file...
CVE-2006-5956
XLineSoft PHPRunner 3.1 stores the 1 database server name, 2 database names, 3 usernames, and 4 passwords in plaintext in %WINDIR%\PHPRunner.ini, which allows local users to obtain sensitive information by reading the file...
CVE-2004-2524
CVE-2004-2524 affects Benchmark Designs’ WHM AutoPilot 2.4.5 and earlier. The vulnerability arises when clogin.php uses clogin_e and base64_encode to encode the target user ID in the c parameter, allowing remote attackers to read plaintext usernames and passwords from the resulting form. The desc...
CVE-2004-2524
clogin.php in Benchmark Designs' WHM AutoPilot 2.4.5 and earlier allows remote attackers to obtain plaintext username and password credentials by using the clogine and base64encode functions to encode the desired user ID in the c parameter, then read the plaintext values in the resulting form...
CVE-2004-2400
WinFTP Server 1.6 stores username and password credentials in plaintext in the data\user.wfd file, which allows local users to gain access to the credentials...
CVE-2004-2400
Summary: CVE-2004-2400 affects WinFTP Server 1.6. The vulnerability arises because credentials (username and password) are stored in plaintext in the file data\user.wfd, allowing local users to obtain credentials. The NVD reports a low base score (2.1) with LOCAL attack vector and PARTIAL confide...
CVE-2005-2395
Affected software: Mozilla Firefox 1.0.4 and 1.0.5. Vulnerability type / cause: Firefox may not select the strongest available HTTP authentication challenge as required by RFC2617, potentially causing credentials to be sent in plaintext even when an encrypted channel exists. Impact (as stated): c...