159 matches found
The vulnerability of the Dr.Web Enterprise Security Suite, a antivirus software, allows a malicious individual to carry out XSS attacks.
The vulnerability of the Dr.Web Enterprise Security Suite anti-virus protection allows for XSS attacks due to insufficient validation of the user name in the web administrator’s login page. This means that before the user name is returned to the user, it may be compromised by a malicious actor...
PCS pcsd competitive conditions loophole
PCS is a set of tools for configuring and managing Pacemaker and Corosync clustering software using the command line and web UI. A competitive condition vulnerability exists in PCS 0.9.139 and prior versions of pcsd that stems from the program's use of global variables to validate usernames. A...
CVE-2009-1273
pamssh 1.92 and possibly other versions, as used when PAM is compiled with USE=ssh, generates different error messages depending on whether the username is valid or invalid, which makes it easier for remote attackers to enumerate usernames...
username not validated in add user to favourites action
Entering a bogus username here has the unwanted side effect of adding a bogus entity to your user favourites that can't be removed...
username not validated in add user to favourites action
Entering a bogus username here has the unwanted side effect of adding a bogus entity to your user favourites that can't be removed...
username not validated in add user to favourites action
Entering a bogus username here has the unwanted side effect of adding a bogus entity to your user favourites that can't be removed...
Design/Logic Flaw
OMEGA aka Omegasoft INterneSErvicesLosungen INSEL 7 generates different responses depending on whether or not a username is valid in a failed login attempt, which allows remote attackers to enumerate valid usernames...
Debian Security Advisory DSA 1276-1 (krb5)
The remote host is missing an update to krb5 announced via advisory DSA 1276-1. Several remote vulnerabilities have been discovered in the MIT reference implementation of the Kerberos network authentication protocol suite, which may lead to the execution of arbitrary code. The Common...
CVE-2006-1644
InterAct 2.1.1’s login.php reveals an information-disclosure vulnerability: responses differ for valid vs invalid usernames, enabling remote enumeration of usernames. Affected component is login handling in Interact 2.1.1; root cause is input-based response variance. Impact is partial confidentia...
Code injection
The 1 elog.c and 2 elogd.c components in elog before 2.5.7 r1558-4 generate different responses depending on whether or not a username is valid, which allows remote attackers to determine valid usernames...
CVE-2006-0599
CVE-2006-0599 affects the elog/elogd components in the Debian elog package prior to version 2.5.7+r1558-4. The vulnerability causes the system to emit different error messages for invalid passwords versus invalid usernames, enabling remote attackers to probe for valid usernames (information discl...
Important: Red Hat Security Advisory: squid security update
An updated Squid package that fixes several security issues is now available. This update has been rated as having important security impact by the Red Hat Security Response Team. Squid is a full-featured Web proxy cache. A buffer overflow flaw was found in the Gopher relay parser. This bug could...
RHEL 2.1 / 3 : squid (RHSA-2005:061)
An updated Squid package that fixes several security issues is now available. Squid is a full-featured Web proxy cache. A buffer overflow flaw was found in the Gopher relay parser. This bug could allow a remote Gopher server to crash the Squid proxy that reads data from it. Although Gopher server...
Important: Red Hat Security Advisory: squid security update
An updated Squid package that fixes several security issues is now available. Squid is a full-featured Web proxy cache. A buffer overflow flaw was found in the Gopher relay parser. This bug could allow a remote Gopher server to crash the Squid proxy that reads data from it. Although Gopher server...
[SECURITY] [DSA 634-1] New hylafax packages fix unauthorised access
-------------------------------------------------------------------------- Debian Security Advisory DSA 634-1 [email protected] http://www.debian.org/security/ Martin Schulze January 11th, 2005 http://www.debian.org/security/faq -...
[SECURITY] [DSA 634-1] New hylafax packages fix unauthorised access
-------------------------------------------------------------------------- Debian Security Advisory DSA 634-1 [email protected] http://www.debian.org/security/ Martin Schulze January 11th, 2005 http://www.debian.org/security/faq -...
DSA-634-1 hylafax - weak hostname and username validation
Bulletin has no description...
qpopper timing analysis on to determine if a username exists on a system
Hello, during development of a pop3 tool I found an issue that makes it possible for any user to check the validity of a user on a target system. If a user is valid and an invalid password has been supplied, then the system waits 10 seconds until it sends a disconnect message and disconnect. If t...