3357 matches found
WebLogic management servlet
The remote web server is WebLogic An internal management servlet which does not properly check user credential can be accessed from outside, allowing a cracker to change user passwords, and even upload or download any file on the remote server. In addition to this, there is a flaw in WebLogic 7.0...
Oracle 9iAS OWA UTIL access
Oracle 9iAS can provide access to the PL/SQL application OWAUTIL that provides web access to some stored procedures. These procuedures, without authentication, can allow users to access sensitive information such as source code of applications, user credentials to other database servers and run...
CVE-2005-3414
eyeOS 0.8.4 stores usrinfo.xml under the web document root with insufficient access control, which allows remote attackers to obtain user credentials...
CVE-2005-3414
CVE-2005-3414 affects eyeOS 0.8.4. The issue arises from storing usrinfo.xml in the web document root with insufficient access control, allowing remote attackers to obtain user credentials. The available connected documents confirm eyeOS 0.8.4 and the credential exposure risk, but do not provide ...
CVE-2005-3414
eyeOS 0.8.4 stores usrinfo.xml under the web document root with insufficient access control, which allows remote attackers to obtain user credentials...
[SA17105] eyeOS Script Insertion and Exposure of User Credentials
TITLE: eyeOS Script Insertion and Exposure of User Credentials SECUNIA ADVISORY ID: SA17105 VERIFY ADVISORY: http://secunia.com/advisories/17105/ CRITICAL: Less critical IMPACT: Cross Site Scripting, Exposure of sensitive information WHERE: From remote SOFTWARE: eyeOS 0.x...
CVE-2005-2962
The post-installation script for ntlmaps before 0.9.9 sets world-readable permissions for the configuration file, which allows local users to obtain the username and password...
Malicious setRequestHeader cross-site vulnerability
A malicious setRequestHeader can be used to stealuser credentials and inject cross-site JavaScript...
PHP-Fusion 6.00.109 - 'msg_send' SQL Injection
SQL Injection, poc: http://target/pathtoPhpFusion/messages.php?msgsend=' UNION SELECT userpassword FROM fusionusers WHERE username='adminusername'/ inserted the above for a better description /str0ke 19.17 28/09/2005 -- PhpF600109xpl.php PHP-Fusion v6.00.109 SQL Injection / admin|users credential...
PHP-Fusion 6.00.109 (msg_send) SQL Injection Exploit
Exploit for unknown platform in category web applications ==================================================== PHP-Fusion 6.00.109 msgsend SQL Injection Exploit ==================================================== SQL Injection, poc: http://target/pathtoPhpFusion/messages.php?msgsend=' UNION SELE...
PHP Advanced Transfer Manager <= 1.30 Multiple Vulnerabilities
Binary data 3234.prm...
Security Flaw in pam_per_user Module
Summary/Impact: --------------- There is a security flaw in the pamperuser PAM module that can allow someone to authenticate as any user on the system, provided that they already have the proper credentials for one account. This security hole is fixed in pamperuser-0.4, which is available from:...
CVE-2005-2859
Savant Web Server stores user credentials in plaintext in the Savant\Users registry key, which allows local users to gain privileges...
CVE-2005-2859
Savant Web Server stores user credentials in plaintext in the Savant\Users registry key, enabling local privilege escalation. Affected component: Savant Web Server; root cause: plaintext credential storage leading to unauthorized access. CVSS2 shows LOCAL attack with low complexity; base impact i...
CVE-2005-2859
Savant Web Server stores user credentials in plaintext in the Savant\Users registry key, which allows local users to gain privileges...
Microsoft Windows keyboard events design flow
Application with diferent user's credentials may send keyboard events to applications running in the same desktop emulating user input...
phorum5x.txt
======================================================================================= XOR Crew :: Security Advisory 9/1/2005 ======================================================================================= Phorum 5.x Multiple XSS and Session Hijacking Vulnerabilities...
Flatnuke 2.5.6 (possibly prior versions) Underlying system information disclosure / Administrative & users credentials disclosure
Flatnuke 2.5.6 Underlying system information disclosure / Administrative & users credentials disclosure / cross site scripting / path disclosure / resource consumption poc tested on Windows software: site: http://flatnuke.sourceforge.net/flatnuke/ 1 cross site scripting:...
flatnuke256.txt
Flatnuke 2.5.6 Underlying system information disclosure / Administrative & users credentials disclosure / cross site scripting / path disclosure / resource consumption poc tested on Windows software: site: http://flatnuke.sourceforge.net/flatnuke/ 1 cross site scripting:...
SqWebMail 5.0.4 - HTML Email IMG Tag Script Injection
source: https://www.securityfocus.com/bid/14676/info SqWebMail is affected by a vulnerability that may allow remote attackers to inject and execute arbitrary script code in a user's browser. This may allow for various attacks including session hijacking due to the theft of user credentials...