2294 matches found
Microsoft ActiveSync弱口令混淆信息泄露漏洞
BUGTRAQ ID: 25976 CVECAN ID: CVE-2007-5460 Microsoft ActiveSync是用于同步计算机与PDA的应用程序。 ActiveSync设备建立连接口令交换的过程实现上存在漏洞，攻击者可能利用此漏洞获取口令信息。 插入到USB口时设备会使用类似于标准网络接口的连接，获得IP地址后设备会通过RAPI在990/TCP端口初始化与主机的通讯，这个过程也会经历一个小型的握手例程，如果合适的话，会对主机挑战设备PIN或口令。用户提供了主机的PIN/口令后，会通过XOR与E9固定密钥进行混淆，然后通过USB网络连接发送给设备进行验证。...
Code injection
Microsoft ActiveSync 4.1, as used in Windows Mobile 5.0, uses weak encryption XOR obfuscation with a fixed key when sending the user's PIN/Password over the USB connection from the host to the device, which might make it easier for attackers to decode a PIN/Password obtained by 1 sniffing or 2...
CVE-2007-5460
Microsoft ActiveSync 4.1, as used in Windows Mobile 5.0, uses weak encryption XOR obfuscation with a fixed key when sending the user's PIN/Password over the USB connection from the host to the device, which might make it easier for attackers to decode a PIN/Password obtained by 1 sniffing or 2...
CVE-2003-1352
Gabber 0.8.7 sends an email to a specific address during user login and logout, which allows remote attackers to obtain user session activity and Gabber version number by sniffing...
CVE-2003-1352
CVE-2003-1352 relates to Gabber 0.8.7, where an info-leak occurs because the client sends an email to a specific address during user login and logout. This behavior can let an attacker sniff (eavesdrop) user session activity and reveal the Gabber version number. The published data indicates a med...
CVE-2007-5034
ELinks before 0.11.3, when sending a POST request for an https URL, appends the body and content headers of the POST request to the CONNECT request in cleartext, which allows remote attackers to sniff sensitive data that would have been protected by TLS. NOTE: this issue only occurs when a proxy ...
CVE-2007-5034
ELinks before 0.11.3, when sending a POST request for an https URL, appends the body and content headers of the POST request to the CONNECT request in cleartext, which allows remote attackers to sniff sensitive data that would have been protected by TLS. NOTE: this issue only occurs when a proxy ...
DEBIAN-CVE-2007-5034
ELinks before 0.11.3, when sending a POST request for an https URL, appends the body and content headers of the POST request to the CONNECT request in cleartext, which allows remote attackers to sniff sensitive data that would have been protected by TLS. NOTE: this issue only occurs when a proxy ...
CVE-2007-5034
CVE-2007-5034 affects ELinks prior to 0.11.3. When sending a POST over HTTPS via a proxy, the body and headers of the POST are appended to the CONNECT request in cleartext, enabling potential disclosure of sensitive data. Impact: information disclosure via TLS-protected traffic when a HTTPS proxy...
CVE-2007-4961
The logintosimulator method in Linden Lab Second Life, as used by the secondlife:// protocol handler and possibly other Second Life login mechanisms, sends an MD5 hash in cleartext in the passwd field, which allows remote attackers to login to an account by sniffing the network and then sending...
Authentication flaw
The logintosimulator method in Linden Lab Second Life, as used by the secondlife:// protocol handler and possibly other Second Life login mechanisms, sends an MD5 hash in cleartext in the passwd field, which allows remote attackers to login to an account by sniffing the network and then sending...
CVE-2007-4961
The logintosimulator method in Linden Lab Second Life, as used by the secondlife:// protocol handler and possibly other Second Life login mechanisms, sends an MD5 hash in cleartext in the passwd field, which allows remote attackers to login to an account by sniffing the network and then sending...
CVE-2007-4961
The CVE-2007-4961 description documents an authentication flaw in Linden Lab Second Life: the login_to_simulator method (used by the secondlife:// protocol handler) transmits an MD5 hash in cleartext in the passwd field, enabling an attacker who can sniff network traffic to login to an account by...
Design/Logic Flaw
The AXIS 207W camera uses a base64-encoded cleartext username and password for authentication, which allows remote attackers to obtain sensitive information by sniffing the wireless network or by leveraging unspecified other vectors...
PT-2007-6075 · Linden · Second Life
Name of the Vulnerable Software and Affected Versions: Linden Lab Second Life affected versions not specified Description: The issue concerns the login to simulator method, which sends an MD5 hash in cleartext in the passwd field. This allows remote attackers to login to an account by sniffing th...
CVE-2007-4150
The Visionsoft Audit on Demand Service VSAOD in Visionsoft Audit 12.4.0.0 uses weak cryptography XOR when 1 transmitting passwords, which allows remote attackers to obtain sensitive information by sniffing the network; and 2 storing passwords in the configuration file, which allows local users to...
Default configuration
The default configuration of TIBCO Rendezvous RV 7.5.2 clients, when -no-multicast is omitted, uses a multicast group as the destination for a network message, which might make it easier for remote attackers to capture message contents by sniffing the network...
CVE-2007-4160
The default configuration of TIBCO Rendezvous RV 7.5.2 clients, when -no-multicast is omitted, uses a multicast group as the destination for a network message, which might make it easier for remote attackers to capture message contents by sniffing the network...
CVE-2007-4150
The Visionsoft Audit on Demand Service VSAOD in Visionsoft Audit 12.4.0.0 uses weak cryptography XOR when 1 transmitting passwords, which allows remote attackers to obtain sensitive information by sniffing the network; and 2 storing passwords in the configuration file, which allows local users to...
Design/Logic Flaw
The Visionsoft Audit on Demand Service VSAOD in Visionsoft Audit 12.4.0.0 uses weak cryptography XOR when 1 transmitting passwords, which allows remote attackers to obtain sensitive information by sniffing the network; and 2 storing passwords in the configuration file, which allows local users to...