CVE-2005-2069

The CVE concerns pam_ldap/nss_ldap used with OpenLDAP when the client is referred from a TLS-secured slave to a master; the following connection may not use TLS, allowing passwords to be sniffed. Connected advisories (e.g., Debian DSA-785-1) reference CVE-2005-2069 (and related CVEs) and note upd...

CVE-2002-1872

Consolidated details from multiple sources confirm CVE-2002-1872 affects Microsoft SQL Server 6.0 through 2000 when SQL Authentication is enabled. The underlying issue is weak password encryption using XOR, enabling remote attackers to sniff and decrypt passwords. Affected software: Microsoft SQL...

CVE-2002-1872

Microsoft SQL Server 6.0 through 2000, with SQL Authentication enabled, uses weak password encryption XOR, which allows remote attackers to sniff and decrypt the password...

CVE-2002-1976

ifconfig, when used on the Linux kernel 2.2 and later, does not report when the network interface is in promiscuous mode if it was put in promiscuous mode using PACKETMRPROMISC, which could allow attackers to sniff the network without detection, as demonstrated using libpcap...

CVE-2002-1949

The Network Attached Storage NAS Administration Web Page for Iomega NAS A300U transmits passwords in cleartext, which allows remote attackers to sniff the administrative password...

CVE-2002-1976

ifconfig, when used on the Linux kernel 2.2 and later, does not report when the network interface is in promiscuous mode if it was put in promiscuous mode using PACKETMRPROMISC, which could allow attackers to sniff the network without detection, as demonstrated using libpcap...

CVE-2002-1746

Affected software: Vtun 2.5b1. The CVE describes that remote attackers can inject data into user sessions by sniffing and replaying packets, enabling data injection into sessions. The provided documents do not specify a fix or patch version. No explicit exploitation details beyond the sniffing/re...

CVE-2001-1505

tinc 1.0pre3 and 1.0pre4 allows remote attackers to inject data into user sessions by sniffing and replaying packets...

CVE-2002-1746

Vtun 2.5b1 allows remote attackers to inject data into user sessions by sniffing and replaying packets...

CVE-2001-1505

tinc 1.0pre3 and 1.0pre4 allows remote attackers to inject data into user sessions by sniffing and replaying packets...

CVE-2005-1553

GeoVision Digital Video Surveillance System 6.04, 6.1 and 7.0 use a weak password encryption scheme that enables password sniffing by remote attackers. The provided documents do not include specifics on affected components, root cause details beyond the weak crypto description, or a published rem...

CVE-2005-1553

GeoVision Digital Video Surveillance System 6.04, 6.1 and 7.0 uses a weak encryption scheme to encrypt passwords, which allows remote attackers to obtain the password via sniffing...

CVE-2005-1553

GeoVision Digital Video Surveillance System 6.04, 6.1 and 7.0 uses a weak encryption scheme to encrypt passwords, which allows remote attackers to obtain the password via sniffing...

Mac OS 10.4: new-account-wizzard in Mail 2.0 sends clear-text passwords

Hello there! I reported this bug at 01-May-2005 09:21 PM CEST to Apples bug- reporting facility Problem ID: 4104391 without reply yet. Summary: At its first use, Mail.app 2.0 will launch a new-account-wizzard that leads through the account-creation process. This wizzard asks for a name, a...

Insecure pty permissions in OS X < 10.4

Hi all. Mac OS X 10.3.x and earlier doesn't provide any mechanism for non-setuid-root programs to change permissions on ptys. Hence xterms, screen sessions, and Terminal.app windows with explicitly specified commands are vulnerable to tty sniffing. Note that using Terminal.app's standard terminal...

CVE-2001-1463

The CVE-2001-1463 vulnerability affects RhinoSoft Serv-U 3.0: the remote administration client transmits the user password in plaintext even when S/KEY One-Time Password (OTP) is enabled, enabling an attacker to sniff credentials over the network. The issue is a plaintext password exposure in the...

CVE-2002-1656

CVE-2002-1656 affects X-News (x_news) 1.1 and earlier, a PHP-based news management system that stores user IDs and MD5 password hashes in a world-readable file (db/users.txt). The vulnerability enables an attacker to authenticate as other users by obtaining a password hash (e.g., via sniffing or ...

CVE-2002-1653

Technical details such as affected versions, vulnerable components, and exploit information are not publicly provided in the supplied documents. Monitor for updates from official sources to obtain concrete technical details and remediation guidance.

CVE-2002-1656

X-News xnews 1.1 and earlier allows attackers to authenticate as other users by obtaining the MD5 checksum of the password, e.g. via sniffing or the users.txt data file, and providing it in a cookie...

CVE-2002-1623

The CVE-2002-1623 entry concerns the Internet Key Exchange (IKE) protocol: when using Aggressive Mode for shared secret authentication, identities are not encrypted during negotiation. This can allow remote attackers to determine valid usernames by monitoring responses before password entry or by...