CVE-2008-3514

VMware VirtualCenter 2.5 before Update 2 and 2.0.2 before Update 5 relies on client-side "enabled/disabled functionality" for access control, which allows remote attackers to determine valid user names by enabling functionality in the GUI and then making an "attempt to assign permissions to other...

Design/Logic Flaw

VMware VirtualCenter 2.5 before Update 2 and 2.0.2 before Update 5 relies on client-side "enabled/disabled functionality" for access control, which allows remote attackers to determine valid user names by enabling functionality in the GUI and then making an "attempt to assign permissions to other...

CVE-2008-3514

VMware VirtualCenter 2.5 before Update 2 and 2.0.2 before Update 5 relies on client-side "enabled/disabled functionality" for access control, which allows remote attackers to determine valid user names by enabling functionality in the GUI and then making an "attempt to assign permissions to other...

CVE-2002-2384

The CVE-2002-2384 entry concerns Hotfoon 4.00. hotfoon4.exe stores user names and passwords in cleartext in the hotfoon2 registry key, enabling local users to gain access to user accounts and steal phone service. Root cause: credentials stored in plaintext in a registry location. Impact: local ac...

CVE-2002-2335

Killer Protection 1.0 stores the vars.inc include file under the web root with insufficient access control, which allows remote attackers to obtain user names and passwords and log in using protection.php...

CVE-2007-3598

index.php in vtiger CRM before 5.0.3 allows remote authenticated users to obtain all users' names and e-mail addresses, and possibly change user settings, via a modified record parameter in a DetailView action to the Users module. NOTE: the vendor disputes the changing of settings, reporting that...

CVE-2007-2590

Nokia Intellisync Mobile Suite 6.4.31.2, 6.6.0.107, and 6.6.2.2, possibly involving Novell Groupwise Mobile Server and Nokia Intellisync Wireless Email Express, allows remote attackers to obtain user names and other sensitive information via a direct request to 1 usrmgr/userList.asp or 2...

CVE-2007-2590

Nokia Intellisync Mobile Suite 6.4.31.2, 6.6.0.107, and 6.6.2.2, possibly involving Novell Groupwise Mobile Server and Nokia Intellisync Wireless Email Express, allows remote attackers to obtain user names and other sensitive information via a direct request to 1 usrmgr/userList.asp or 2...

CVE-2007-1647

Moodle 1.5.2 and earlier stores sensitive information under the web root with insufficient access control, and provides directory listings, which allows remote attackers to obtain user names, password hashes, and other sensitive information via a direct request for session sess files in...

WWWboard password disclosure

//A vulnerability found in WWWboard that shows the administrative user names and passwords. Althought the password is hashed, It can easily be decoded. //Effected versions: Version 2.0 ALPHA 2 //File name: passwd.txt //File location: http://victim/wwwboard/passwd.txt //Google dork:...

CVE-2006-6909

Stack-based buffer overflow in http.c in Karl Dahlke Edbrowse aka Command line editor browser 3.1.3 allows remote attackers to execute arbitrary code by operating an FTP server that sends directory listings with 1 long user names or 2 long group names...

BrewBlogger 1.3.1 - 'printLog.php' SQL Injection

!/usr/bin/perl Target: BewBlogger 1.3.1 http://brewblogger.zkdigital.com Vulnerability: SQL Injection Description: BrewBlogger does not properly sanitize the 'id=' parameter passed to printLog.php. Since each user entry contains an auto-incrementing ID number, it is possible to enumerate all user...

CVE-2006-4032

Unspecified vulnerability in Cisco IOS CallManager Express CME allows remote attackers to gain sensitive information user names from the Session Initiation Protocol SIP user directory via certain SIP messages, aka bug CSCse92417...

phpWebSite index.php Search Module SQL Injection

The remote host is running a version of phpWebSite that fails to sanitize user-supplied input to the 'module' parameter of the 'search' module before using it in database queries. An attacker may be able to exploit this issue to obtain sensitive information such as user names and password hashes ...

CVE-2005-0831

PHP-Post allows remote attackers to spoof the names of other users by registering with a username containing hex-encoded characters...

IBM iSeries AS400 LDAP Server - Remote Information Disclosure

source: https://www.securityfocus.com/bid/12991/info A remote information disclosure issue affects IBM iSeries AS400 LDAP Server. This issue is due to a failure of the application to properly secure sensitive information. An authenticated attacker may leverage this issue to disclose user names an...

IBM iSeries AS400 LDAP Server - Remote Information Disclosure

IBM iSeries AS400 LDAP Server - Remote Information Disclosure source: https://www.securityfocus.com/bid/12991/info A remote information disclosure issue affects IBM iSeries AS400 LDAP Server. This issue is due to a failure of the application to properly secure sensitive information. An...

CVE-2005-0831

The vulnerability CVE-2005-0831 affects PHP-Post and allows remote attackers to spoof other users’ names by registering with a username containing hex-encoded characters. The description is confirmed across multiple sources (NVD, Red Hat CVE entry, CVE List) and indicates weak input handling enab...

Opera 7.x/Firefox 1.0/Internet Explorer 6.0 - Information Disclosure

source: https://www.securityfocus.com/bid/12723/info Multiple browsers are reported prone to an information disclosure weakness. This issue can allow an attacker to determine information such as the location of files, file names and user names on a vulnerable computer. Information gathered throug...

Nortel Networks Contivity VPN Client information leakage vulnerability

Overview The Nortel Networks Contivity VPN Client authentication error message provide additional information that may be useful to an attacker. Description The Nortel Networks Contivity VPN Client software provides an encrypted and authenticated VPN connection from a client system to a Nortel...