PHP-Nuke 1.02.53.04.x5.x6.x7.x - modules.php Multiple Cross-Site Scripting Vulnerabilities

PHP-Nuke 1.02.53.04.x5.x6.x7.x - modules.php Multiple Cross-Site Scripting Vulnerabilities source: https://www.securityfocus.com/bid/3609/info PHPNuke is a website creation/maintenance tool. PHPNuke is prone to cross-site scripting attacks. It is possible to create a link to the PHPNuke user...

CVE-1999-1235

CVE-1999-1235 affects Internet Explorer 5.0 and involves the browser recording FTP credentials in the URL history (index.dat) and exposing them via the status bar when hovering links. The underlying issue is that usernames/passwords are stored in client-side history data, enabling local users to ...

CVE-1999-1280

Hummingbird Exceed 6.0.1.0 inadvertently includes a DLL that was meant for development and testing, which logs user names and passwords in cleartext in the test.log file...

Beck GmbH IPC@CHIP HTTPD vulernable to arbitrary file disclosure

Overview The Beck IPC@CHIP web server permits intruders to access files outside the web root. Description The Beck IPC@CHIP is a single chip embedded webserver. The Web Server's root directory is set to / by default. Because of this default setting, an attacker can download arbitrary files from a...

ScreamingMedia SITEWare source code disclosure vulnerability

FS Advisory ID: FS-061201-18-SMSW Release Date: June 11, 2001 Product: ScreamingMedia SITEWare Vendor: ScreamingMedia Inc. http://www.screamingmedia.com Vendor Advisory: http://www.screamingmedia.com/security/sms1001.php Type: Source code disclosure vulnerability Severity: High Author: Mike Shema...

Gene6 BPFTP FTP Server 2.0 - User Credentials Disclosure

Gene6 BPFTP FTP Server 2.0 - User Credentials Disclosure source: https://www.securityfocus.com/bid/2534/info G6 FTP Server now known as BPFTP Server is an internet FTP server by Gene6 If a logged in FTP user connects to an external share and submits a malformed 'size' or 'mdtm' command, the user...

Gene6 BPFTP FTP Server 2.0 - User Credentials Disclosure

source: https://www.securityfocus.com/bid/2534/info G6 FTP Server now known as BPFTP Server is an internet FTP server by Gene6 If a logged in FTP user connects to an external share and submits a malformed 'size' or 'mdtm' command, the user could force the FTP server to make an external SMB...

STAT Security Advisory: Trend Micro's ScanMail for Exchange stores passwords in registry unprotected

================================================================================ == STAT Security Advisory http://www.statonline.com/ Software Vendor: Trend Micro www.antivirus.com Software Package: ScanMail for Exchange Versions Affected: 3.5 Evaluation possibly others Synopsis: Account names an...

CVE-2000-1243

Privacy leak in Dansie Shopping Cart 3.04, and probably earlier versions, sends sensitive information such as user credentials to an e-mail address controlled by the product developers...

MS00-067: Telnet Client NTLM Authentication Vulnerability (272743)

The hotfix for the 'Telnet Client NTLM Authentication' problem has not been applied. This vulnerability may, under certain circumstances, allow a malicious user to obtain cryptographically protected login credentials from another user. C Tenable Network Security, Inc. include"compat.inc"; if...

Win2k Telnet.exe malicious server vulnerability

Microsoft was informed of this problem with exploit over a month ago. I received some token responses right after emailing them, but have heard nothing since. If they have released an advisory of their own yet, I have not seen it. I informed them up-front that I would release a full-disclosure...

Check Point Software Firewall-1 3.01 4.01 4.1 - Session Agent Dictionary Attack (1)

Check Point Software Firewall-1 3.01 4.01 4.1 - Session Agent Dictionary Attack 1 source: https://www.securityfocus.com/bid/1662/info A vulnerability exists in all versions of the Check Point Session Agent, part of Firewall-1. Session Agent works in such a way that the firewall will establish a...

NetZero ZeroPort 3.0 - Weak Encryption Method

NetZero ZeroPort 3.0 - Weak Encryption Method // source: https://www.securityfocus.com/bid/1483/info Netzero is a free internet service provider which requires its users to run the application ZeroPort in order to log onto the network. The username and password is stored locally in a text file...

NetZero ZeroPort 3.0 - Weak Encryption Method

// source: https://www.securityfocus.com/bid/1483/info Netzero is a free internet service provider which requires its users to run the application ZeroPort in order to log onto the network. The username and password is stored locally in a text file called id.dat and is inadequately encrypted. The...

netsurfer.txt

Software: Netsurfer for UNIX version? Platforms: UNIX various ISPs Problem: Any local user can obtain passwords and credit card numbers by elsewhere A problem exists in Netsufer's, Inc. Netsurfer software see www.netsurfer.com that allows the average local user anyone in the user group to obtain...

Citrix Metaframe 1.01.8 - Weak Encryption

Citrix Metaframe 1.01.8 - Weak Encryption // source: https://www.securityfocus.com/bid/1077/info The ICA protocol uses a simple XOR-based encryption algorthm to protect user credentials while stored or in transit. This encryption can be easily broken, meaning that anyone sniffing the connection c...

Citrix Metaframe 1.0/1.8 - Weak Encryption

// source: https://www.securityfocus.com/bid/1077/info The ICA protocol uses a simple XOR-based encryption algorthm to protect user credentials while stored or in transit. This encryption can be easily broken, meaning that anyone sniffing the connection can obtain user access to the server. The I...

Qualcomm qpopper 3.0 - 'LIST' Remote Buffer Overflow

// source: https://www.securityfocus.com/bid/948/info A remotely exploitable buffer-overflow vulnerability affects Qualcomm's 'qpopper' daemon. This issue allows users already in possession of a username and password for a POP account to compromise the server running the qpopper daemon. The probl...

Ipswitch IMail Server 78 - Weak Password Encryption

Ipswitch IMail Server 78 - Weak Password Encryption // source: https://www.securityfocus.com/bid/10956/info Ipswitch IMail is reported to use a weak encryption algorithm when obfuscating saved passwords. A local attacker who has the ability to read the encrypted passwords may easily derive the...

dccsnoop.txt

http://www.rootshell.com/ Date: Wed, 10 Feb 1999 14:24:55 -0800 PST From: Gregory Taylor To: [email protected] Subject: Re: New Exploit - DCCsnoop.txt Discovered by Gregory Taylor Febuary 5th, 1999 It is possible to snoop a user's Linux connection through IRC.. DCC Sending the device files...