SOAP/XML Plaintext Credentials Disclosure

Binary data 4758.prm...

PHPMyAdmin明文密码存储漏洞

BUGTRAQ: 7965 phpMyAdmin以明文格式存储密码，本地攻击者可以用这个漏洞获得Cookie文件中的密码信息，控制phpMyAdmin应用系统。 phpMyAdmin没有使用任何类似BASE64/RadiX64的编码形式，只是简单的把用户数据如用户名和密码以明文方式存储在Cookie文件中，如： pmacookieusername=UserName; lang=language-iso-8859-1; pmacookiepassword=your password 任意本地用户或者远程用户通过跨站脚本执行攻击，可以Cookie信息获得敏感用户信息，从而控制系统。...

Design/Logic Flaw

The Websense Reporter Module in Websense Enterprise 6.3.2 stores the SQL database system administrator password in plaintext in CreateDbInstall.log, which allows local users to gain privileges to the database...

CVE-2008-4646

The CVE concerns the Websense Reporter Module in Websense Enterprise 6.3.2. Affected component: Websense Reporter Module; vulnerability: the SQL database system administrator password is stored in plaintext in CreateDbInstall.log. Root cause: credentials are written to a log file, exposing the pa...

CVE-2008-4646

The Websense Reporter Module in Websense Enterprise 6.3.2 stores the SQL database system administrator password in plaintext in CreateDbInstall.log, which allows local users to gain privileges to the database...

CVE-2008-4491

Apple Mail.app 3.5 on Mac OS X, when "Store draft messages on the server" is enabled, stores draft copies of S/MIME email in plaintext on the email server, which allows server owners and remote man-in-the-middle attackers to read sensitive mail...

Code injection

Apple Mail.app 3.5 on Mac OS X, when "Store draft messages on the server" is enabled, stores draft copies of S/MIME email in plaintext on the email server, which allows server owners and remote man-in-the-middle attackers to read sensitive mail...

CVE-2008-4491

CVE-2008-4491 affects Apple Mail.app 3.5 on Mac OS X. When “Store draft messages on the server” is enabled, draft copies of S/MIME mail are stored in plaintext on the mail server, allowing server admins and remote MITM attackers to read sensitive mail. The provided documents do not include exploi...

CVE-2008-4491

Apple Mail.app 3.5 on Mac OS X, when "Store draft messages on the server" is enabled, stores draft copies of S/MIME email in plaintext on the email server, which allows server owners and remote man-in-the-middle attackers to read sensitive mail...

Gentoo Security Advisory GLSA 200503-29 (GnuPG)

The remote host is missing updates announced in advisory GLSA 200503-29. OpenVAS Vulnerability Test $ Description: Auto generated from Gentoo's XML based advisory Authors: Thomas Reinke Copyright: Copyright c 2008 E-Soft Inc. http://www.securityspace.com Text descriptions are largely excerpted fr...

Gentoo Security Advisory GLSA 200503-29 (GnuPG)

The remote host is missing updates announced in advisory GLSA 200503-29. SPDX-FileCopyrightText: 2008 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Gentoo Security Advisory GLSA 200507-13 (pam_ldap nss_ldap)

The remote host is missing updates announced in advisory GLSA 200507-13. OpenVAS Vulnerability Test $ Description: Auto generated from Gentoo's XML based advisory Authors: Thomas Reinke Copyright: Copyright c 2008 E-Soft Inc. http://www.securityspace.com Text descriptions are largely excerpted fr...

Baidu Hi IM software parsing plaintext stack overflow

Our automatic bug exploiting tools have found a buffer overflow bug in Baidu Hi IM software which is a popular IM software in China. This bug is due to Baidu Hi do not strictly check the deciphered plaintext format in CSTransfer.dll. Because of encryption mechanism of Baidu Hi, it is hard to...

Baidu Hi IM software parsing plaintext stack overflow

Baidu Hi IM software parsing plaintext stack overflow -- CVE ID: Not assigned -- Affected Vendors: Baidu -- Affected Products: Baidu Hi IM software -- Vulnerability Details: Our automatic bug exploiting tools have found a buffer overflow bug in Baidu Hi IM software which is a popular IM software ...

FreeBSD Ports: gnupg

The remote host is missing an update to the system as announced in the referenced advisory. SPDX-FileCopyrightText: 2008 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

FreeBSD Ports: kdebase, kdelibs

The remote host is missing an update to the system as announced in the referenced advisory. VID 4593cb09-4c81-11d9-983e-000c6e8f12ef OpenVAS Vulnerability Test $ Description: Auto generated from vuxml or freebsd advisories Authors: Thomas Reinke Copyright: Copyright c 2008 E-Soft Inc...

FreeBSD Ports: nwclient

The remote host is missing an update to the system as announced in the referenced advisory. VID d177d9f9-e317-11d9-8088-00123f0f7307 OpenVAS Vulnerability Test $ Description: Auto generated from vuxml or freebsd advisories Authors: Thomas Reinke Copyright: Copyright c 2008 E-Soft Inc...

Yet another wretched trick: Surf Jacking-vulnerability warning-the black bar safety net

Author: thorn This technique is today EnableSecurityissue. The prerequisite is to be able tointercepted trafficit. Specifically, it can monitor the uplink traffic, you can modify the downstream flow. Method by the arp spoofing, DNS spoofing, wireless monitor or the like. Some people might say, ca...

atmail541-download.txt

@Mail PHP Version 5.41 patch Release http://atmail.com/demo/atmailphpdemo.tgz The default install of Atmail 5.41 creates the following file in the atmail/ directory: build-plesk-upgrade.php If that file is called via http, such as: http://example.com/atmail/build-plesk-upgrade.php it will execute...

EMC Retrospect弱哈希算法口令泄露漏洞

BUGTRAQ ID: 30319,30308 EMC Retrospect是Windows平台下的备份和恢复软件。 Retrospect备份客户端在网络中以明文传输口令哈希。如果远程攻击者向客户端发送了恶意报文的话，客户端的响应信息中就会包含有明文口令，导致损失保密性；此外Retrospect备份服务器的认证模块使用了弱口令哈希算法，攻击者可以较容易的暴力猜测。 EMC Retrospect for Windows 7.5.508 EMC --- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：...