Mac OS X LDAP plugins transmit user credentials in clear text

Overview Versions 10.2 and later of Apple's MacOS X operating system include support for the Lightweight Directory Access Protocol LDAP. A vulnerability in the way some of these versions of MacOS X handle authentication in certain environments could expose user's passwords in plaintext as they're...

Pablo Software Solutions FTP Service 1.2 - Plaintext Password

source: https://www.securityfocus.com/bid/7801/info It has been reported that Pablo FTP Service stores FTP User account passwords in plaintext format. As a result, these credentials could be exposed to other users. It should be noted that while this weakness has been reported to affect Pablo FTP...

CVE-2003-0342

Summary: CVE-2003-0342 affects BlackMoon FTP Server 2.6 Free Edition (and possibly other distributions). Affected component is the blackmoon.mdb database where usernames and passwords are stored in plaintext. The underlying issue enables local users who have an account on the host to read credent...

PHP-Nuke 6.5 - 'modules.php?Username' Cross-Site Scripting

source: https://www.securityfocus.com/bid/7570/info A cross site scripting vulnerability has been reported for PHP-Nuke. Specifically, PHP-Nuke does not sufficiently sanitize user-supplied input for the 'username' URI parameter to the modules.php script. This may allow for theft of cookie-based...

Sambar Server Cleartext Password Transmission

The remote Sambar server allows users to log in without using SSL. A man-in-the-middle attacker can exploit this to capture the passwords of the users of this server. The attacker can then use these to access the web mail accounts and modify the web pages on behalf of the users of the system. C...

rpc.walld fails to properly validate messages before broadcasting to clients

Overview A vulnerability in rpc.walld may allow local users to forge wall messages. An exploit exists for this vulnerability and is publically available. Description From the rpc.walld man page:The wall command reads the named file, or, if no filename appears, it reads the standard input until an...

CVE-2002-1427

The printhtmltofile function in edit.cgi for Easy Homepage Creator 1.0 does not check user credentials, which allows remote attackers to modify home pages of other users...

CVE-2002-1427

The CVE-2002-1427 entry affects Easy Homepage Creator 1.0. The print_html_to_file function in edit.cgi does not validate user credentials, enabling remote attackers to modify other users’ home pages. CVSS v2 data reports a base score of 7.5 ( HIGH ) with network attack vector, no authentication, ...

Microsoft Internet Explorer allows arbitrary local file reading via "showHelp()" function

Overview A vulnerability in Microsoft Internet Explorer IE allows remote attackers to read arbitrary files on a vulnerable system. Description A vulnerability in the showHelp Method contained within IE may allow a remote attacker to read arbitrary files. For further details, please see the...

APBoard 2.0 2 - Unauthorized Thread Reading

APBoard 2.0 2 - Unauthorized Thread Reading source: https://www.securityfocus.com/bid/6330/info A vulnerability has been reported for APBoard that may allow unauthorized users to read postings in internal forums. The vulnerability is a result of the 'useraction.php' script failing to properly che...

APBoard 2.0 2 - Unauthorized Thread Reading

source: https://www.securityfocus.com/bid/6330/info A vulnerability has been reported for APBoard that may allow unauthorized users to read postings in internal forums. The vulnerability is a result of the 'useraction.php' script failing to properly check user credentials...

vBulletin 2.0.x2.2.x - members2.php Cross-Site Scripting

vBulletin 2.0.x2.2.x - members2.php Cross-Site Scripting source: https://www.securityfocus.com/bid/6246/info Due to insufficient sanitization of user supplied values, it is possible to exploit a vulnerability in VBulletin. By passing an invalid value to a variable located in 'members2.php', it is...

CVE-2002-0715

Vulnerability in Squid before 2.4.STABLE6 related to proxy authentication credentials may allow remote web sites to obtain the user's proxy login and password...

CVE-2002-0715

Vulnerability in Squid before 2.4.STABLE6 related to proxy authentication credentials may allow remote web sites to obtain the user's proxy login and password...

OpenSSH 2.x3.x - Kerberos 4 TGTAFS Token Buffer Overflow

OpenSSH 2.x3.x - Kerberos 4 TGTAFS Token Buffer Overflow source: https://www.securityfocus.com/bid/4560/info A buffer overflow condition exists in the OpenSSH server. The condition is exploitable by attackers with valid user credentials in versions 2.9.9 and higher. Exploitation does not require...

OpenSSH 2.x/3.x - Kerberos 4 TGT/AFS Token Buffer Overflow

source: https://www.securityfocus.com/bid/4560/info A buffer overflow condition exists in the OpenSSH server. The condition is exploitable by attackers with valid user credentials in versions 2.9.9 and higher. Exploitation does not require valid user credentials in versions prior to 2.9.9. The...

CVE-1999-1215

LOGIN.EXE program in Novell Netware 4.0 and 4.01 temporarily writes user name and password information to disk, which could allow local users to gain privileges...

Castelle Faxpress: Password used for NT Print queue can be discl osed in Plain Text

Overview I have reported this to Castelle and they told me it is a feature for troubleshooting, however they will make the change the next time they release the Faxpress Software. I just thought that other admins should be made aware so they can check their systems are secured correctly. Printing...

Faq-O-Matic 2.62.7 - Cross-Site Scripting

Faq-O-Matic 2.62.7 - Cross-Site Scripting source: https://www.securityfocus.com/bid/4023/info FAQ-O-Matic is a freely available, open-source FAQ Frequently Asked Questions manager. It is intended to run on Linux and Unix variants. FAQ-O-Matic does not sufficiently filter script code from URL...

Faq-O-Matic 2.6/2.7 - Cross-Site Scripting

source: https://www.securityfocus.com/bid/4023/info FAQ-O-Matic is a freely available, open-source FAQ Frequently Asked Questions manager. It is intended to run on Linux and Unix variants. FAQ-O-Matic does not sufficiently filter script code from URL parameters. It is possible to create a malicio...