CVE-2004-1870

PhotoPost PHP Pro 4.6.x and earlier are affected by multiple SQL injection vulnerabilities. The CVE entry references attackers being able to extract user passwords via parameters such as photo (addfav.php, comments.php), credit (comments.php), cat (index.php, showgallery.php), ppuser (showgallery...

CVE-2004-1870

Multiple SQL injection vulnerabilities in PhotoPost PHP Pro 4.6.x and earlier allow remote attackers to gain users' passwords via the 1 photo parameter to addfav.php, 2 photo parameter to comments.php, 3 credit parameter to comments.php, 4 cat parameter to index.php, 5 ppuser parameter to...

DUPortal/DUPortal Pro Multiple Scripts SQL Injection (1)

The remote host is running DUPortal, a content management system written in ASP. The remote version of this software is vulnerable to several SQL injection vulnerabilities in files 'details.asp', 'search.asp', 'default.asp' , 'cat.asp' and more. With a specially crafted URL, an attacker can explo...

CVE-2001-1476

SSH before 2.0, with RC4 encryption and the "disallow NULL passwords" option enabled, makes it easier for remote attackers to guess portions of user passwords by replaying user sessions with certain modifications, which trigger different messages depending on whether the guess is correct or not...

NotifyLink administrative interface displays user passwords in clear text

Overview The NotifyLink web interface grants administrative users inappropriate access to private user password information. Description Notify Technology NotifyLink Enterprise Server allows users to synchronize e-mail between a PDA and a mail server. The application consists of a PDA-specific...

USN-88-1: reportbug information disclosure

Rolf Leggewie discovered two information disclosure bugs in reportbug. The per-user configuration file /.reportbugrc was created world-readable. If it contained email smarthost passwords, these were readable by any other user on the computer storing the home directory. reportbug usually includes...

PeerFTP FTP Server weak encryption

User passwords are stored in the world readable file...

LiteForum 2.1.1 - SQL Injection

LiteForum 2.1.1 - SQL Injection !/usr/bin/perl use LWP::UserAgent; LiteForum 2.1.1 http://www.softtime.ru sql injection exploit work on all mysql versions by 1dt.w0lf RusH security team http://rst.void.ru --------------------------------------- greets 2: ghc www.ghc.ru Gh0st Security Team...

DEBIAN-CVE-2004-0923

CUPS 1.1.20 and earlier records authentication information for a device URI in the errorlog file, which allows local users to obtain user names and passwords...

CVE-2004-0621

admin.php in Newsletter ZWS allows remote attackers to gain administrative privileges via a listuser operation with the ulevel parameter set to 1 administrator level, which lists all users and their passwords...

CVE-2002-1096

Cisco VPN 3000 Concentrator 2.2.x, and 3.x before 3.5.1, allows restricted administrators to obtain user passwords that are stored in plaintext in HTML source code...

CVE-2004-0412

Mailman before 2.1.5 allows remote attackers to obtain user passwords via a crafted email request to the Mailman server...

SQL Injection Vulnerability in FuzzyMonkey MyClassifieds SQL Version

SQL Injection Vulnerability in FuzzyMonkey MyClassifieds SQL Version 18 October 2003 Original Advisory http://www.sintelli.com/adv/sa-2003-04-myclassified.pdf Background My Classifieds SQL is a Perl/CGI/MySQL script which will quickly and easily allow the hosting of a classifieds forum on a...

FuzzyMonkey 2.11 - MyClassifieds Email Variable SQL Injection

FuzzyMonkey 2.11 - MyClassifieds Email Variable SQL Injection source: https://www.securityfocus.com/bid/8863/info It has been reported that FuzzyMonkey MyClassifieds may be prone to a SQL injection vulnerability that may allow an attacker to disclose user passwords by supplying malicious SQL code...

MySQL 3.23.x4.0.x - Password Handler Buffer Overflow

MySQL 3.23.x4.0.x - Password Handler Buffer Overflow source: https://www.securityfocus.com/bid/8590/info MySQL server has been reported prone to a buffer overflow vulnerability when handling user passwords of excessive size. The issue presents itself, due to a lack of sufficient bounds checking...

SNMPc information leak

On unauthorized user's requests server leaks users information incliduing passwords...

e107 website system Vulnerability

Informations : Advisory Name: e107 website system Vulnerability Author: hiruvim [email protected] Discover by: hiruvim [email protected] Website vendor : http://e107.org Affected Systems: All versions Severity: High Platforms: Windows and Unix Issue: Security holes enable attackers to get MySQL...

DSA-338 proftpd - SQL injection

Bulletin has no description...

Xpressions Interactive Multiple Products login.asp SQL Injection

The remote host appears to be running a software suite truConnect, FlowerLink, eVision, or Website Integration from Xpressions Software. The software in question has multiple SQL injection vulnerabilities that could allow an attacker to gain administrative access. This could lead to the exposure ...

FileMaker Pro Client Request User Passwords Remote Disclosure

The remote host is running a FileMakerPro server. There is a flaw in the design of the FileMakerPro server which makes the database authentication occur on the client side. A remote attacker could exploit this flaw to gain access to databases by connecting to this port with a rogue client. C...