CVE-2005-4219

CVE-2005-4219 affects Innovative CMS (ICMS, formerly Imoel-CMS). The setting.php page reportedly returns cleartext username and password information, potentially allowing an attacker to obtain credentials via a direct request. The NVD entry assigns a base CVSS v2 of 5.0 (Medium): Attack Vector Ne...

CVE-2004-2578

PhpGroupWare before 0.9.16.002 transmits the (1) admin header and (2) setup passwords in plaintext via cookies, allowing remote attackers to sniff passwords over the network. The issue is documented with CVSS v2 base score 5.0 (AV:N/AC:L/Au:N/C:P/I:N/A:N). Concrete affected product/component: Php...

CVE-2002-2190

ArtsCore Studios CuteCast Forum 1.2 stores passwords in plaintext under the web document root, which allows remote attackers to obtain the passwords via an HTTP request to a .user file...

CVE-2002-2143

The admin.html file in MySimple News 1.0 stores its administrative password in plaintext, which allows remote attackers to gain unauthorized access to the web server by viewing the source of admin.html...

CVE-2002-2190

The CVE relates to ArtsCore Studios CuteCast Forum 1.2, where user passwords are stored in plaintext under the web document root. The underlying vulnerability is improper password storage, enabling remote attackers to retrieve passwords by requesting a ".user" file over HTTP. The available source...

CVE-2002-2143

The CVE-2002-2143 issue affects MySimple News 1.0 where the admin.html page stores the administrative password in plaintext, enabling remote attackers to gain unauthorized access by viewing the page source. According to the sources, this exposes partial confidentiality, integrity, and availabilit...

CVSTrac database plaintext password storage

The remote host seems to be running cvstrac, a web-based bug and patch-set tracking system for CVS. This version contains a flaw related to .db files that may allow an attacker to gain access to plaintext passwords. OpenVAS has determined the vulnerability exists on the target simply by looking a...

CVE-2005-3429

Rockliffe MailSite Express before 6.1.22, with the option to save login information enabled, saves user passwords in plaintext in cookies, which allows local users to obtain passwords by reading the cookie file, or remote attackers to obtain the cookies via cross-site scripting XSS vulnerabilitie...

CVE-2005-3429

Rockliffe MailSite Express before 6.1.22 stores user passwords in plaintext in cookies when the “save login information” option is enabled. This enables local users to read cookies to obtain passwords and allows remote attackers to steal cookies via cross-site scripting (XSS) vulnerabilities. Aff...

CVE-2005-3203

The manual installation of Oracle HTML DB HTMLDB 1.3 through 1.3.6 stores the SYS password in install.lst in plaintext, which allows local users to gain privileges...

CVE-2005-3203

The manual installation of Oracle HTML DB HTMLDB 1.3 through 1.3.6 stores the SYS password in install.lst in plaintext, which allows local users to gain privileges...

[Full-disclosure] Plaintext Password Vulnerabilitiy during Installation of Oracle HTMLDB

Plaintext Password Vulnerabilitiy during Installation of Oracle HTMLDB Name Cross-Site-Scripting Vulnerabilities in Oracle XMLDB Systems Affected Oracle HTMLDB Severity Low Risk Category Plaintext Password of SYS is logged during Installation of HTMLDB Vendor URL http://www.oracle.com This adviso...

CVE-2005-3036

CVE-2005-3036 affects File Transfer Anywhere 3.01, where a sensitive password is stored in plaintext in the PASS value of the program’s registry key. The root cause is plaintext credential storage in the registry, enabling local users to gain privileges. Impact: local privilege escalation as desc...

CVE-2005-2866

Mercora IMRadio 4.0.0.0 stores usernames and passwords in plaintext in the MercoraClient\Profiles registry key, which allows local users to gain privileges...

CVE-2005-2664

Whisper 32 1.16, and possibly earlier versions, stores passwords in plaintext in memory, which allows local users to obtain the password using a debugger or another mechanism to read process memory...

CVE-2005-2620

grpWise.exe for Novell GroupWise client 5.5 through 6.5.2 stores the password in plaintext in memory, which allows attackers to obtain the password using a debugger or another mechanism to read process memory...

CVE-2005-2620

The CVE affects Novell GroupWise Windows clients (5.x–6.5.2) where the grpWise.exe process stores passwords in plaintext in memory. This allows a local attacker with access (e.g., via memory dump/read mechanisms or a debugger) to recover credentials. The issue is a memory-credential caching probl...

kayakoBad.txt

GulfTech Security Research July 30th, 2005 Vendor : Kayako Web Solutions URL : http://www.kayako.com/ Version : Kayako liveResponse v2.x Risk : Multiple Vulnerabilities Description: Kayako liveResponse is a web based application aimed at providing live support for websites and businesses. There a...

CVE-2005-2444

The CVE-2005-2444 issue affects Trillian Pro 3.1 build 121. When checking Yahoo mail, the application stores the Yahoo password in plaintext in a world-readable file and does not delete the file after login. This creates a local-privilege risk where users on the same machine can read sensitive cr...

Kayako liveResponse Multiple Vulnerabilities

GulfTech Security Research July 30th, 2005 Vendor : Kayako Web Solutions URL : http://www.kayako.com/ Version : Kayako liveResponse v2.x Risk : Multiple Vulnerabilities Description: Kayako liveResponse is a web based application aimed at providing live support for websites and businesses. There a...