IPSwitch IMail Server 8.1 - Local Password Decryption Utility

/ IpSwitch IMail Server IpSwitch IMail Server uses weak encryption algorithm to encrypt its user passwords. It uses polyalphabetic Vegenere cipher to encrypt its user passwords. This encryption scheme is relatively easy to break. In order to decrypt user password we need a key. IMail uses usernam...

Bugzilla < 2.16.6 / 2.18rc1 Multiple Vulnerabilities (XSS, SQLi, Priv Esc, more)

The remote Bugzilla bug tracking system, according to its version number, is vulnerable to various flaws : - An administrator may be able to execute arbitrary SQL commands on the remote host. - There are instances of information leaks that may let an attacker know the database password under...

ZWS Newsletter & Mailing List Manager

hello , i'm a frenchy boy and excuse me for my bad english... i decover a bug in the newsletter ZWS , http://www.target.com/newsletter/admin.php?f=listuser&uname=test&ulevel=1 with this , you can list all user register in the newsletter with respective password. after u log with a account Admin ,...

CVE-2004-0082

The mksmbpasswd shell script mksmbpasswd.sh in Samba 3.0.0 and 3.0.1, when creating an account but marking it as disabled, may overwrite the user password with an uninitialized buffer, which could enable the account with a more easily guessable password...

Cisco Security Advisory: Cisco Personal Assistant User Password Bypass Vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Cisco Security Advisory: Cisco Personal Assistant User Password Bypass Vulnerability Document ID: 47765 Revision 1.0 FINAL For Public Release 2004 January 8 17:00 UTC GMT - ----------------------------------------------------------------------- Conten...

Cisco Personal Assistant User Password Bypass Vulnerability

...

CVE-2003-1295

Unspecified vulnerability in xscreensaver 4.12, and possibly other versions, allows attackers to cause xscreensaver to crash via unspecified vectors "while verifying the user-password."...

CVE-2003-1295

Unspecified vulnerability in xscreensaver 4.12, and possibly other versions, allows attackers to cause xscreensaver to crash via unspecified vectors "while verifying the user-password."...

CVE-2003-0968

Stack-based buffer overflow in SMBLogonServer of the rlmsmb experimental module for FreeRADIUS 0.9.3 and earlier allows remote attackers to execute arbitrary code via a long User-Password attribute...

CVE-2003-0968

Stack-based buffer overflow in SMBLogonServer of the rlmsmb experimental module for FreeRADIUS 0.9.3 and earlier allows remote attackers to execute arbitrary code via a long User-Password attribute...

[Hat-Squad] phpBB search_id injection exploit

Hello list, Here is the exploit code for phpbb 2.06 sql injection described in http://www.securityfocus.com/archive/1/345872 . It will return MD5 password hash of specified user as highlight variable for viewtopic.php in search results page...

[Full-Disclosure] VieNuke VieBoard SQL Injection Vulnerability... again

--- http://www.securityfocus.com/bid/8967/info/ ... Solution: VieNuke has released a patch: http://www.vienuke.com/VieBoardPatch.zip ... --- http://www.securityfocus.com/bid/8967/solution/ ... VieNuke VieBoard 2.6 Beta 1: VieNuke Patch VieBoardPatch.zip http://www.vienuke.com/VieBoardPatch.zip...

Planet switches - 2 серия

Добрый день. Если помните, http://www.security.nnov.ru/search/news.asp?binid=3174 Та же "закладка" присутствует в Planet WSW-2401. Тот же пользователь, тот же пароль. Проблема усугубляется тем, что управляющий IP-интерфейс доступен через ЛЮБОЙ 802.1q-VLAN, присутствующий в свитче. Это касается и...

e107 db.php User Database Disclosure

The version of e107 installed on the remote host is affected by an information disclosure vulnerability because of a flaw in the 'admin/db.php' script. This can allow an unauthenticated, remote attacker to obtain a dump of the SQL database used by e107, by sending a specially crafted request. An...

Asus AAM6000EV ADSL Router Wide Open

Asus have been notified but haven't even acknowledged yet alone mentioned a fix. If the inbuilt webserver is activated, anyone on the local network can get the full user/pass list from the router without any identification whatsoever by going to the ip address of the router and appending /userdat...

Information Disclosure Vulnerability in board51, forum51 and news51

================================================ ------------------------------------------------ ------------www.bright-shadows.net------------ ------------------------------------------------ --------------theblacksheep&erik-------------- ------------------------------------------------...

phpBB 2.0.5 SQL Injection password disclosure Exploit

Exploit for unknown platform in category web applications ===================================================== phpBB 2.0.5 SQL Injection password disclosure Exploit ===================================================== !/usr/bin/perl -w phpBB password disclosure vuln. - rick patel There is a sql...

phpBB 2.0.5 SQL Injection password disclosure Exploit

No description provided by source. !/usr/bin/perl -w phpBB password disclosure vuln. - rick patel There is a sql injection vuln which exists in /viewtopic.php file. The variable is $topicid which gets passed directly to sql server in query. Attacker could pass a special sql string which can used ...

phpBB 2.0.5 - SQL Injection Password Disclosure

phpBB 2.0.5 - SQL Injection Password Disclosure !/usr/bin/perl -w phpBB password disclosure vuln. - rick patel There is a sql injection vuln which exists in /viewtopic.php file. The variable is $topicid which gets passed directly to sql server in query. Attacker could pass a special sql string...

FlashFXP 1.4 - User Password Encryption

FlashFXP 1.4 - User Password Encryption // source: https://www.securityfocus.com/bid/7499/info FlashFXP uses a trivially reversible algorithm to encrypt FTP user credentials. Local attackers with access to the sites.data may exploit this weakness to gain unauthorized access to FTP user credential...