2238 matches found
WebEOC handles sensitive information in an insecure manner
Overview WebEOC handles sensitive information in an insecure manor. As a result, sensitive information may be exposed to untrusted parties. Description WebEOC is a web-based crisis information management application that provides functions to gather, coordinate, and disseminate information betwee...
Windows XP / 2000 / 2003 / NT named pipes usernames information leak
It's possible to retrieve usernames of the users accessing network resources...
CVE-2002-1903
Pine 4.2.1 through 4.4.4 puts Unix usernames and/or uid into Sender: and X-Sender: headers, which could allow remote attackers to obtain sensitive information...
CVE-2002-1903
Pine 4.2.1–4.4.4 exposes Unix usernames and/or UIDs in the Sender: and X-Sender: headers, enabling potential information disclosure to remote attackers.
CVE-2005-2013
paFAQ 1.0 Beta 4 allows remote attackers to obtain sensitive information via a direct request to admin/backup.php, which contains a backup of the database including usernames and passwords...
CVE-2005-2013
paFAQ 1.0 Beta 4 allows remote attackers to obtain sensitive information via a direct request to admin/backup.php, which contains a backup of the database including usernames and passwords...
CVE-2005-1828
D-Link DSL-504T stores usernames and passwords in cleartext in the router configuration file, which allows remote attackers to obtain sensitive information...
CVE-2005-1733
CVE-2005-1733 affects Cookie Cart: password file passwd.txt is stored under the web document root with insufficient access control, enabling remote retrieval of usernames and encrypted passwords via a direct request. CVSS v2 base score 5.0 (Medium). No exploitation details or fixes are provided i...
CVE-2005-1733
Cookie Cart stores the password file under the web document root with insufficient access control, which allows remote attackers to obtain usernames and encrypted passwords via a direct request to passwd.txt...
CVE-2005-1733
Cookie Cart stores the password file under the web document root with insufficient access control, which allows remote attackers to obtain usernames and encrypted passwords via a direct request to passwd.txt...
CVE-2005-1650
The web mail service in Woppoware PostMaster 4.2.2 build 3.2.5 generates different error messages depending on whether a user exists or not, which allows remote attackers to determine valid usernames...
CVE-2005-1648
Gurgens GASoft Ultimate Forum 1.0 stores the db/Genid.dat database file under the web document root with insufficient access control, which allows remote attackers to obtain and decrypt usernames and passwords...
CVE-2005-1650
The web mail service in Woppoware PostMaster 4.2.2 build 3.2.5 generates different error messages depending on whether a user exists or not, which allows remote attackers to determine valid usernames...
CVE-2005-1647
Gurgens GASoft Guest Book 2.1 stores the db/Genid.dat database file under the web document root with insufficient access control, which allows remote attackers to obtain and decrypt usernames and passwords...
CVE-2005-0938
Ublog Reload 1.0 through 1.0.4 stores ublogreload.mdb under the web root, which allows remote attackers to read usernames and hashed passwords via a direct request to ublogreload.mdb...
CVE-2005-0422
DelphiTurk CodeBank aka KodBank 3.1 and earlier stores usernames and passwords in the Codebank registry key, which allows local users to gain privileges...
CVE-2002-1637
Multiple components in Oracle 9i Application Server 9iAS are installed with over 160 default usernames and passwords, including 1 SYS, 2 SYSTEM, 3 AQJAVA, 4 OWA, 5 IMAGEUSER, 6 USER1, 7 USER2, 8 PLSQL, 9 DEMO, 10 FINANCE, and many others, which allows attackers to gain privileges...
CVE-2002-1623
The CVE-2002-1623 entry concerns the Internet Key Exchange (IKE) protocol: when using Aggressive Mode for shared secret authentication, identities are not encrypted during negotiation. This can allow remote attackers to determine valid usernames by monitoring responses before password entry or by...
CVE-2002-1623
The design of the Internet Key Exchange IKE protocol, when using Aggressive Mode for shared secret authentication, does not encrypt initiator or responder identities during negotiation, which may allow remote attackers to determine valid usernames by 1 monitoring responses before the password is...