CVE-2001-1463

The remote administration client for RhinoSoft Serv-U 3.0 sends the user password in plaintext even when S/KEY One-Time Password OTP authentication is enabled, which allows remote attackers to sniff passwords...

RhinoSoft Serv-U remote administration client transmits password in plaintext

Overview A vulnerability exists in the remote administration client for RhinoSoft Serv-U. During the authentication process, the client ignores the S/KEY one-time password OTP challenge sent by the server and sends the password entered by the user in plaintext. Description RhinoSoft Serv-U is a...

CVE-2001-1098

Cisco PIX firewall manager PFM 4.32g logs the enable password in plaintext in the pfm.log file, which could allow local users to obtain the password by reading the file...

CVE-1999-1275

Lotus cc:Mail release 8 stores the postoffice password in plaintext in a hidden file which has insecure permissions, which allows local users to gain privileges...

CVE-1999-1561

Technical details about CVE-1999-1561 are not publicly provided in the supplied documents. Monitor for updates from official advisories; no concrete affected products, versions, or fixes are present here.

CVE-1999-1275

The CVE-1999-1275 entry describes a local privilege escalation in Lotus cc:Mail release 8. The issue arises because the postoffice password is stored in plaintext in a hidden file with insecure permissions, allowing local users to access the password and gain privileges. The vulnerability affects...

CVE-2001-1111

EFTP 2.0.7.337 stores user passwords in plaintext in the eftp2users.dat file...

CVE-1999-1256

Oracle Database Assistant 1.0 in Oracle 8.0.3 Enterprise Edition stores the database master password in plaintext in the spoolmain.log file when a new database is created, which allows local users to obtain the password from that file...

CVE-1999-1562

The CVE-1999-1562 entry concerns gFTP, affected versions 1.13 and all before 2.0.0, which may log a user password in plaintext either in the GUI log window or in a log file. This is a plaintext credential exposure vulnerability in the logging path. Debian’s advisory (DSA-084-1) notes a fix in ver...

Multiple Vulnerabilities In AMLServer

Strumpf Noir Society Advisories ! Public release ! -- -= Multiple Vulnerabilities In AMLServer =- Release date: Monday, June 18, 2001 Introduction: Air Messenger LAN Server is a paging gateway server for MS Windows that allows you to send and recieve messages to a paging network over a TCP/IP LAN...

SpyAnywhere Authentication Bypassing Vulnerabilities

Strumpf Noir Society Advisories ! Public release ! -- -= SpyAnywhere Authentication Bypassing Vulnerabilities =- Release date: Tuesday, May 22, 2001 Introduction: Spytech's SpyAnywhere application is a remote PC monitoring and administration package for the MS Windows OS. SpyAnywhere can be...

CVE-2000-0957

The pluggable authentication module for mysql pammysql before 0.4.7 does not properly cleanse user input when constructing SQL statements, which allows attackers to obtain plaintext passwords or hashes...

CVE-2000-1076

Netscape iPlanet Certificate Management System 4.2 and Directory Server 4.12 stores the administrative password in plaintext, which could allow local and possibly remote attackers to gain administrative privileges on the server...

CVE-2000-1076

Netscape iPlanet Certificate Management System 4.2 and Directory Server 4.12 stores the administrative password in plaintext, which could allow local and possibly remote attackers to gain administrative privileges on the server...

CVE-2000-0777

CVE-2000-0777 concerns Microsoft Money: the password protection feature stores the password in plaintext, enabling local attackers with physical access to extract it. CVSSv2 base score 7.2 (HIGH) with LOCAL access, LOW attack complexity, and full impact on confidentiality, integrity, and availabi...

CVE-2000-0402

CVE-2000-0402 concerns Information Disclosure in Microsoft SQL Server 7.0: the sa password is stored in plaintext in a log file (sqlsp.log) readable by any user. This vulnerability is described as the "SQL Server 7.0 Service Pack Password" issue. Public references in the provided documents point ...

CVE-2000-0434

The CVE-2000-0434 issue concerns the Allmanage web site administration software. The underlying problem is that the administrative password is stored in plaintext in a file that could be accessed by remote attackers. This creates the potential for an attacker to obtain the password and gain unaut...

CVE-2000-0434

The administrative password for the Allmanage web site administration software is stored in plaintext in a file which could be accessed by remote attackers...

RedHat 6.2 - Piranha Virtual Server Package Plaintext Password

RedHat 6.2 - Piranha Virtual Server Package Plaintext Password source: https://www.securityfocus.com/bid/1367/info Password changes submitted to Red Hat Piranha via HTTP are insecurely passed as variables in a GET request. Unauthorized users could obtain the password by reading the httpd access l...

Shiva Access Manager 5.0.0 Plaintext LDAP root password.

In testing Intel's Shiva Access Manager RADIUS/Tacacs+ product, i recently came across an important security hole in the LDAP connectivity on the Solaris platform version of this product. When you configure the S.A.M. to store all of it's information in an LDAP directory, it asks that you give it...