Oracle Portal 10g HTTP Response Splitting

Oracle Portal/Applications HTTP Response Splitting -------------------------------------------------- Sample: http://target/webapp/jsp/calendar.jsp?enc=iso-8859-10d0aContent-length=120d0a0d0a3Cscript3Ealert'hi'3C/script3E How an attack can be conducted? ------------------------------- Oracle Port...

CVE-2006-6238

The AutoFill feature in Apple Safari 2.0.4 does not properly verify that all automatically populated form fields are visible to the user, which allows remote attackers to obtain sensitive information, such as usernames and passwords, via input fields of zero width, a variant of CVE-2006-6077...

CVE-2006-4403

The FTP server in Apple Mac OS X 10.4.8 and earlier, when FTP Access is enabled, will crash when a login failure occurs with a valid user name, which allows remote attackers to cause a denial of service crash and enumerate valid usernames...

BrewBlogger 1.3.1 (printLog.asp) Remote SQL Injection Vulnerability

No description provided by source. !/usr/bin/perl Target: BewBlogger 1.3.1 http://brewblogger.zkdigital.com Vulnerability: SQL Injection Description: BrewBlogger does not properly sanitize the 'id=' parameter passed to printLog.php. Since each user entry contains an auto-incrementing ID number, i...

BrewBlogger 1.3.1 (printLog.php) Remote SQL Injection Vulnerability

No description provided by source. !/usr/bin/perl Target: BewBlogger 1.3.1 http://brewblogger.zkdigital.com Vulnerability: SQL Injection Description: BrewBlogger does not properly sanitize the 'id=' parameter passed to printLog.php. Since each user entry contains an auto-incrementing ID number, i...

Y.A.N.S sql injection

Product: YANS yet another news system Link: http://sourceforge.net/projects/yans/ vuln code: $resultado = mysqlquery"SELECT FROM users WHERE username='$username' AND password='$password'" or die mysqlerror; simple sql injection ' or '1=1 ' or '1=1 -navairum...

Novell NetMail buffer overflow

Buffer overflow on parsing usernames with '.'...

CVE-2006-5229

OpenSSH portable 4.1 on SUSE Linux, and possibly other platforms and versions, and possibly under limited configurations, allows remote attackers to determine valid usernames via timing discrepancies in which responses take longer for valid usernames than invalid ones, as demonstrated by sshtime...

yet another OpenSSH timing leak?

Hello Bugtraq, Here we are again... During a recent penetration test i stumbled upon yet another OpenSSH timing leak, leading to remote disclosure of valid usernames. It's not as big as the one i found in the past CVE-2003-0190, but it can indeed be exploited over the Internet, nevertheless. This...

OpenSSH < 4.4 Multiple Vulnerabilities

According to its banner, the version of OpenSSH installed on the remote host is affected by multiple vulnerabilities : - A race condition exists that may allow an unauthenticated, remote attacker to crash the service or, on portable OpenSSH, possibly execute code on the affected host. Note that...

CVE-2006-5052

Unspecified vulnerability in portable OpenSSH before 4.4, when running on some platforms, allows remote attackers to determine the validity of usernames via unknown vectors involving a GSSAPI "authentication abort."...

CVE-2006-5052

Unspecified vulnerability in portable OpenSSH before 4.4, when running on some platforms, allows remote attackers to determine the validity of usernames via unknown vectors involving a GSSAPI "authentication abort."...

CVE-2006-4595

muforum µforum 0.4c stores membres/members.dat under the web document root with insufficient access control, which allows remote attackers to obtain sensitive information such as usernames and password hashes...

CVE-2006-4615

Shape Services IM+ Mobile Instant Messenger for Pocket PC 3.10 stores usernames and passwords in plaintext in %PROGRAMFILES%\IMPlus\implus.cfg, which allows local users to obtain sensitive information by reading the file...

CVE-2006-4595

muforum µforum 0.4c stores membres/members.dat under the web document root with insufficient access control, which allows remote attackers to obtain sensitive information such as usernames and password hashes...

CVE-2006-4487

DUware DUpoll 3.0 and 3.1 stores private/Dupoll.mdb under the web document root with insufficient access control, which allows remote attackers to obtain sensitive information such as usernames and passwords...

publically available usernames are a security risk

The login username of users is revealed all over the place in URLs that link to user profile, or user's list of assigned open bugs etc. This seems to be a big security risk, because you have given away half of the user identification to strangers. Anybody can look up a user in the issue tracker a...

publically available usernames are a security risk

The login username of users is revealed all over the place in URLs that link to user profile, or user's list of assigned open bugs etc. This seems to be a big security risk, because you have given away half of the user identification to strangers. Anybody can look up a user in the issue tracker a...

CVE-2006-3272

Cross-site request forgery CSRF vulnerability in menu.php in Some Chess 1.5 rc2 allows remote attackers to conduct actions as another user, such as changing usernames and passwords, via unspecified vectors. NOTE: the provenance of this information is unknown; the details are obtained from third...

mysql security update

CentOS Errata and Security Advisory CESA-2006:0544 Updated mysql packages that fix multiple security flaws are now available. This update has been rated as having important security impact by the Red Hat Security Response Team. MySQL is a multi-user, multi-threaded SQL database server. MySQL is a...