CVE-2004-1609

SalesLogix 6.1 is affected by CVE-2004-1609, where usernames, passwords, and other sensitive data are sent in HTTP response headers. The underlying issue exposes partial confidentiality and could let remote attackers gain access. The CVSS v2 base score is 5.0 (MEDIUM) with network attack vector a...

CVE-2004-1697

The CVE-2004-1697 issue affects CA Unicenter Management Portal versions 2.0 and 3.1, where the Forgot your Password link reveals different error messages for existing vs non-existing usernames, enabling remote username guessing. Underlying cause is information disclosure through authentication er...

CVE-2004-1602

ProFTPD 1.2.x, including 1.2.8 and 1.2.10, responds in a different amount of time when a given username exists, which allows remote attackers to identify valid usernames by timing the server response...

CVE-2004-1428

ArGoSoft FTP before 1.4.2.1 generates an error message if the user name does not exist instead of prompting for a password, which allows remote attackers to determine valid usernames...

PerlDesk 1.x - SQL Injection

PerlDesk 1.x - SQL Injection !/usr/bin/perl Example: kb.cgi?view=0 UNION SELECT 1,3,password,username,3,7 FROM users Exploit is attached. ./pde.pl www.internethosting4u.com /perldesk/kb.cgi 148.244.150.58:80 use IO::Socket; print ' PerlDesk exploit Usage: ./pdsploit.pl host path proxy Vunerabilit...

PerlDesk 1.x - SQL Injection

!/usr/bin/perl Example: kb.cgi?view=0 UNION SELECT 1,3,password,username,3,7 FROM users Exploit is attached. ./pde.pl www.internethosting4u.com /perldesk/kb.cgi 148.244.150.58:80 use IO::Socket; print ' PerlDesk exploit Usage: ./pdsploit.pl host path proxy Vunerability discovered by deluxe89 and...

[SA13843] Squid Username Whitespace Security Bypass Issue

TITLE: Squid Username Whitespace Security Bypass Issue SECUNIA ADVISORY ID: SA13843 VERIFY ADVISORY: http://secunia.com/advisories/13843/ CRITICAL: Less critical IMPACT: Security Bypass WHERE: From local network SOFTWARE: Squid 2.x http://secunia.com/product/310/ DESCRIPTION: A security issue has...

CVE-2005-0121

Multiple buffer overflows in golddig 2.0 and earlier allow local users to execute arbitrary code via 1 a long map name command line argument or 2 a long username as recorded in the USER environment variable...

ITA Forum <= 1.49 SQL Injection Exploit

Exploit for unknown platform in category web applications ======================================= ITA Forum = 1.49 SQL Injection Exploit ======================================= !/usr/bin/perl use LWP::UserAgent; ITA Forum 1.49 sql injection exploit with one char bruteforce by 1dt.w0lf // r57...

ArGoSoft FTP Server reveals valid usernames and allows for brute force attacks

Vendor: ArGoSoft Date: December 31, 2004 Issue: ArGoSoft FTP Server reveals valid usernames and allows for brute force attacks URL: http://www.argosoft.com/ftpserver/ Advisory: http://www.lovebug.org/argosoftadvisory.txt Program Overview: ArGoSoft FTP Server is a lightweight FTP Server for...

CVE-2004-2419

Keene Digital Media Server 1.0.2 allows local users to obtain usernames and passwords by reading the dmscore.db file on the local system...

ProFTPD Login Timing Account Name Enumeration

The remote ProFTPd server is as old or older than 1.2.10 It is possible to determine which user names are valid on the remote host based on timing analysis attack of the login procedure. An attacker may use this flaw to set up a list of valid usernames for a more efficient brute-force attack...

CVE-2004-1694

Symantec ON Command CCM 5.4.x and iCommand 3.0.x has four default usernames and passwords, one of which is hardcoded, which allows remote attackers to gain unauthorized access...

CVE-2002-1530

The CVE concerns SurfControl SuperScout Email Filter, specifically its administrative web interface STEMWADM. A vulnerability in the userlist.asp page allows an attacker to retrieve usernames and plaintext passwords via the user editing form, exposing credential data through the management UI. Th...

CVE-2004-0042

vsftpd 1.1.3 generates different error messages depending on whether or not a valid username exists, which allows remote attackers to identify valid usernames...

CVE-2004-0042

vsftpd 1.1.3 generates different error messages depending on whether or not a valid username exists, which allows remote attackers to identify valid usernames...

CVE-2003-1404

DotBr 0.1 stores config.inc with insufficient access control under the web document root, which allows remote attackers to obtain sensitive information such as SQL usernames and passwords...

Webeye unauthorized access

It's possible to retrieve full usernames/passwords list...

Microsoft SQL Server < 7 Local Privilege Escalation

Based on its version number, the remote host may be vulnerable to a local exploit wherein an authenticated user can obtain and crack SQL usernames and passwords from the registry. An attacker may use this flaw to elevate their privileges on the local database. This alert might be a false positive...

ftgatepro.txt

TITLE: FTGatePro Exposure of Sensitive Information SECUNIA ADVISORY ID: SA9719 VERIFY ADVISORY: http://www.secunia.com/advisories/9719/ CRITICAL: Less critical IMPACT: Exposure of sensitive information WHERE: From remote SOFTWARE: FTGatePro Mail Server 1.x DESCRIPTION: Two vulnerabilities have be...