Cache: NonManagedConnectionFactory will log password in clear text when an exception occurs

The NonManagedConnectionFactory in JBoss Enterprise Application Platform EAP 5.1.2 and 5.2.0, Web Platform EWP 5.1.2 and 5.2.0, and BRMS Platform before 5.3.1 logs the username and password in cleartext when an exception is thrown, which allows local users to obtain sensitive information by readi...

MailPost vulnerable to cross-site scripting via an executable requested with a trailing slash appended to the filename

Overview A cross-site scripting vulnerability is reported to exist in MailPost version 5.1.1sv and possibly earlier versions. Description According to a report by ProCheckUp, MailPost is vulnerable to a Cross-Site Scripting attack by adding a trailing '/' character to the executable filename. The...

Microsoft IIS ODBC Tool getdrvrs.exe DSN Creation

ODBC tools are present on the remote host. ODBC tools could allow a malicious user to hijack and redirect ODBC traffic, obtain SQL user names and passwords or write files to the local drive of a vulnerable server. Example: http://www.example.com/scripts/tools/getdrvrs.exe %NASLMINLEVEL 70300 This...

FileMaker Pro network protocol sends passwords to any client attempting to connect to a shared database.

I recently discovered a serious bug in FileMaker Pro's database sharing. FileMaker have just released an advisory about this on their security pages: http://www.filemaker.com/support/security -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Subject: FileMaker Pro network protocol sends passwords to...

NSFOCUS SA2000-09 : AHG EZshopper Loadpage.cgi File List Disclosure Vulnerability

NSFOCUS Security AdvisorySA2000-09 Topic: AHG EZshopper Loadpage.cgi File List Disclosure Vulnerability Release DateЈє Dec 13rd, 2000 CVE Candidate Numbers: CAN-2000-1092 Affected system: ================ Alex Heiphetz Group EZshopper v.3.0 for Unix Alex Heiphetz Group EZshopper v.2.0 for Unix...

napster.path-disclosure.txt

-------------------------------------------------- time 1:30 am date 9-18-00 affected systems: any system running napster client hasn't been tested for the gnapster client -------------------------------------------------- ADVISORY: here goes...... hi lindsay, pat, jason , and t-rex After running...

NSFOCUS Security Advisory 2000.2

ISBASE Security AdvisorySA2000-02 Topic: IIS ISM.DLL truncation exposes file content Release Date: July 17, 2000 Affected software version: =========================== Microsoft Internet Information Server 4.0 Microsoft Internet Information Server 5.0 Platform: ========== Windows NT 4.0 and Windo...

Alert: MS Index Server (CISADV000330)

Cerberus Information Security Advisory CISADV000330 http://www.cerberus-infosec.co.uk/advisories.shtml Released : 30th March 2000 Name : Index Server Strike 3! Affected Systems : Microsoft Internet Information Server Issue : Attackers can gain source of ASP and other pages Author : David Litchfie...