oracle-enum-users NSE Script

Attempts to enumerate valid Oracle user names against unpatched Oracle 11g servers this bug was fixed in Oracle's October 2009 Critical Patch Update. Script Arguments oracle-enum-users.sid the instance against which to attempt user enumeration tns.sid See the documentation for the tns library...

domino-enum-users NSE Script

Attempts to discover valid IBM Lotus Domino users and download their ID files by exploiting the CVE-2006-5835 vulnerability. Script Arguments domino-enum-users.path the location to which any retrieved ID files are stored domino-enum-users.username the name of the user from which to retrieve the I...

Apache Tomcat < 6.0.18 UTF8 Directory Traversal Vulnerability

No description provided by source. /Apache Tomcat 6.0.18 UTF8 Directory Traversal Vulnerability get /etc/passwd Exploit c0d3r: mywisdom thanks for not being lame to change exploit author tis is one of my linux w0rm module for user enumerations, i've dual os worm thanks to:...

SMTP User Enumeration Utility

The SMTP service has two internal commands that allow the enumeration of users: VRFY confirming the names of valid users and EXPN which reveals the actual address of users aliases and lists of e-mail mailing lists. Through the implementation of these SMTP commands can reveal a list of valid users...

Apache Tomcat User Enumeration

This module enumerates Apache Tomcat's usernames via malformed requests to jsecuritycheck, which can be found in the web administration package. It should work against Tomcat servers 4.1.0 - 4.1.39, 5.5.0 - 5.5.27, and 6.0.0 - 6.0.18. Newer versions no longer have the "admin" package by default...

Gridsphere - gridportlet User Enumeration

!/usr/bin/python Gridsphere - gridportlet remote user enumeration exploit Copyright IPSECS c 2010 http://ipsecs.com Thanks to underground people who gives idea about python and javascript You know who you are :- import sys,re,os from urllib2 import urlopen You need to install ClientForm from this...

FreeBSD : moodle -- multiple vulnerabilities (f6429c24-4fc9-11df-83fb-0015587e2cc1)

The Moodle release notes report multiple vulnerabilities which could allow remote attackers to perform, amongst others, cross site scripting, user enumeration and SQL injection attacks. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin wer...

LDAP User Enumeration

By using the search base gathered by plugin ID 25701, Nessus was able to enumerate the list of users in the remote LDAP directory. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid45478; scriptversion"1.8"; scriptsetattributeattribute:"pluginmodificationdate",...

moodle -- multiple vulnerabilities

The Moodle release notes report multiple vulnerabilities which could allow remote attackers to perform, amongst others, cross site scripting, user enumeration and SQL injection attacks...

SMB User Enumeration (SAM EnumUsers)

Determine what users exist via the SAM RPC service This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'SMB User Enumeration SAM EnumUsers', 'Description' = 'Determine what users exist via the SAM R...

LDAP - Injection

Vurnerebility: LDAP Injection + Category : Implemented Web exploit + Category : Attack Technique + Author : mc2s3lector + dork : X/o" + Contact : www.yogyacarderlink.web.id + date : 4-2-10 + biGthank to : Allah SWT,jasakom,KeDai Computerworks,0n3-d4y n3ro,eplaciano, all.indonesian like a coding,...

Multiple Vulnerabilities in Cisco Unified MeetingPlace

No description provided by source. Cisco Security Advisory: Multiple Vulnerabilities in Cisco Unified MeetingPlace Advisory ID: cisco-sa-20100127-mp Revision 1.0 For Public Release 2010 Jan 27 1600 UTC GMT +--------------------------------------------------------------------- Summary =======...

mysql-users NSE Script

Attempts to list all users on a MySQL server. Script Arguments mysqluser The username to use for authentication. If unset it attempts to use credentials found by mysql-brute or mysql-empty-password. mysqlpass The password to use for authentication. If unset it attempts to use credentials found by...

Security fix for the ALT Linux 5 package tomcat6 version 0:6.0.18-alt6_8jpp5

Jan. 14, 2010 Slava Semushin 0:6.0.18-alt68jpp5 - NMU - Applied upstream patches to fix following vulnerabilities: + CVE-2009-0033: DoS when using Java AJP connector Closes: 20313 + CVE-2009-0580: User enumeration vulnerability with FORM authentication Closes: 20315 + CVE-2009-0781: XSS in calend...

SuSE 10 Security Update : Tomcat 5 (ZYPP Patch Number 6352)

This update of tomcat fixes several vulnerabilities : - RequestDispatcher usage can lead to information leakage. CVE-2008-5515 - denial of service via AJP connection. CVE-2009-0033 - some authentication classes allow user enumeration. CVE-2009-0580 - XSS bug in example application cal2.jsp...

openSUSE Security Update : tomcat6 (tomcat6-999)

This update of tomcat fixes several vulnerabilities : - CVE-2008-5515: RequestDispatcher usage can lead to information leakage - CVE-2009-0033: denial of service via AJP connection - CVE-2009-0580: some authentication classes allow user enumeration - CVE-2009-0781: XSS bug in example application...

Code injection

The Sametime server in IBM Lotus Instant Messaging and Web Conferencing 6.5.1 generates error messages for a failed logon attempt with different time delays depending on whether the user account exists, which allows remote attackers to enumerate valid usernames...

Design/Logic Flaw

WordPress and WordPress MU before 2.8.1 exhibit different behavior for a failed login attempt depending on whether the user account exists, which allows remote attackers to enumerate valid usernames. NOTE: the vendor reportedly disputes the significance of this issue, indicating that the behavior...

CVE-2009-2335

WordPress and WordPress MU before 2.8.1 exhibit different behavior for a failed login attempt depending on whether the user account exists, which allows remote attackers to enumerate valid usernames. NOTE: the vendor reportedly disputes the significance of this issue, indicating that the behavior...

CVE-2009-2335

CVE-2009-2335 affects WordPress and WordPress MU prior to 2.8.1, where a failed login behaves differently depending on whether the user account exists, enabling remote enumeration of valid usernames. The vendor reportedly disputes the significance of the issue, calling the behavior for user conve...