3107 matches found
ASP-DEV Discussion Forum 2.0 - Admin Directory Weak Default Permissions
source: https://www.securityfocus.com/bid/8172/info It has been reported that a vulnerability exists in ASP-DEV Discussion Forum that exposes potentially sensitive information. Because of this, an attacker may be able to gain access to user credentials. User credentials are stored in the...
Domain User Credentials access via OWA XSS
On my previous post about OWA XSS I talked about Cross Site Scripting in the attachment field of a mail. The XSS is not in the attachment, is in the body of the message. Sorry, I need to sleep... Please notice: not in the attachment, in the BODY. To make it clear to understand I have just publish...
XMB Forum 1.8 - 'member.php' Cross-Site Scripting
source: https://www.securityfocus.com/bid/7662/info XMB Forum has been reported prone to a cross-site scripting vulnerability. XMB Forum fails to adequately filter script code from URL parameters, making it prone to cross-site scripting attacks. Attacker-supplied script code may be included in a...
Mac OS X LDAP plugins transmit user credentials in clear text
Overview Versions 10.2 and later of Apple's MacOS X operating system include support for the Lightweight Directory Access Protocol LDAP. A vulnerability in the way some of these versions of MacOS X handle authentication in certain environments could expose user's passwords in plaintext as they're...
Pablo Software Solutions FTP Service 1.2 - Plaintext Password
source: https://www.securityfocus.com/bid/7801/info It has been reported that Pablo FTP Service stores FTP User account passwords in plaintext format. As a result, these credentials could be exposed to other users. It should be noted that while this weakness has been reported to affect Pablo FTP...
CVE-2003-0342
Summary: CVE-2003-0342 affects BlackMoon FTP Server 2.6 Free Edition (and possibly other distributions). Affected component is the blackmoon.mdb database where usernames and passwords are stored in plaintext. The underlying issue enables local users who have an account on the host to read credent...
PHP-Nuke 6.5 - 'modules.php?Username' Cross-Site Scripting
source: https://www.securityfocus.com/bid/7570/info A cross site scripting vulnerability has been reported for PHP-Nuke. Specifically, PHP-Nuke does not sufficiently sanitize user-supplied input for the 'username' URI parameter to the modules.php script. This may allow for theft of cookie-based...
Sambar Server Cleartext Password Transmission
The remote Sambar server allows users to log in without using SSL. A man-in-the-middle attacker can exploit this to capture the passwords of the users of this server. The attacker can then use these to access the web mail accounts and modify the web pages on behalf of the users of the system. C...
rpc.walld fails to properly validate messages before broadcasting to clients
Overview A vulnerability in rpc.walld may allow local users to forge wall messages. An exploit exists for this vulnerability and is publically available. Description From the rpc.walld man page:The wall command reads the named file, or, if no filename appears, it reads the standard input until an...
CVE-2002-1427
The CVE-2002-1427 entry affects Easy Homepage Creator 1.0. The print_html_to_file function in edit.cgi does not validate user credentials, enabling remote attackers to modify other users’ home pages. CVSS v2 data reports a base score of 7.5 ( HIGH ) with network attack vector, no authentication, ...
CVE-2002-1427
The printhtmltofile function in edit.cgi for Easy Homepage Creator 1.0 does not check user credentials, which allows remote attackers to modify home pages of other users...
Microsoft Internet Explorer allows arbitrary local file reading via "showHelp()" function
Overview A vulnerability in Microsoft Internet Explorer IE allows remote attackers to read arbitrary files on a vulnerable system. Description A vulnerability in the showHelp Method contained within IE may allow a remote attacker to read arbitrary files. For further details, please see the...
APBoard 2.0 2 - Unauthorized Thread Reading
APBoard 2.0 2 - Unauthorized Thread Reading source: https://www.securityfocus.com/bid/6330/info A vulnerability has been reported for APBoard that may allow unauthorized users to read postings in internal forums. The vulnerability is a result of the 'useraction.php' script failing to properly che...
APBoard 2.0 2 - Unauthorized Thread Reading
source: https://www.securityfocus.com/bid/6330/info A vulnerability has been reported for APBoard that may allow unauthorized users to read postings in internal forums. The vulnerability is a result of the 'useraction.php' script failing to properly check user credentials...
vBulletin 2.0.x2.2.x - members2.php Cross-Site Scripting
vBulletin 2.0.x2.2.x - members2.php Cross-Site Scripting source: https://www.securityfocus.com/bid/6246/info Due to insufficient sanitization of user supplied values, it is possible to exploit a vulnerability in VBulletin. By passing an invalid value to a variable located in 'members2.php', it is...
CVE-2002-0715
Vulnerability in Squid before 2.4.STABLE6 related to proxy authentication credentials may allow remote web sites to obtain the user's proxy login and password...
CVE-2002-0715
Vulnerability in Squid before 2.4.STABLE6 related to proxy authentication credentials may allow remote web sites to obtain the user's proxy login and password...
OpenSSH 2.x/3.x - Kerberos 4 TGT/AFS Token Buffer Overflow
source: https://www.securityfocus.com/bid/4560/info A buffer overflow condition exists in the OpenSSH server. The condition is exploitable by attackers with valid user credentials in versions 2.9.9 and higher. Exploitation does not require valid user credentials in versions prior to 2.9.9. The...
OpenSSH 2.x3.x - Kerberos 4 TGTAFS Token Buffer Overflow
OpenSSH 2.x3.x - Kerberos 4 TGTAFS Token Buffer Overflow source: https://www.securityfocus.com/bid/4560/info A buffer overflow condition exists in the OpenSSH server. The condition is exploitable by attackers with valid user credentials in versions 2.9.9 and higher. Exploitation does not require...