CVE-2002-2410

openwebmail.pl in Open WebMail 1.7 and 1.71 reveals sensitive information in error messages and generates different responses whether a user exists or not, which allows remote attackers to identify valid usernames via brute force attacks and obtain certain configuration and version information...

CVE-2002-2335

Killer Protection 1.0 stores the vars.inc include file under the web root with insufficient access control, which allows remote attackers to obtain user names and passwords and log in using protection.php...

DEBIAN-CVE-2002-1347

Multiple buffer overflows in Cyrus SASL library 2.1.9 and earlier allow remote attackers to cause a denial of service and possibly execute arbitrary code via 1 long inputs during user name canonicalization, 2 characters that need to be escaped during LDAP authentication using saslauthd, or 3 an...

wp--02-0005: Multiple Vulnerabilities in SuperScout Web Reports Server

Westpoint Security Advisory Title: Multiple Vulnerabilities in SuperScout Web Reports Server Risk Rating: High Software: SurfControl SuperScout WebFilter Platforms: Win32 WinNT/ Win2k Vendor URL: www.surfcontrol.com Author: Matt Moore [email protected] Date: 1st October 2002 Advisory ID:...

Firewall-1 usernames detection

PKI aggressive mode replies are different for existing and non-existing usernames...

KaZaa v1.7.1 Denial of Service Attack

Submitted by : Josh [email protected], omega [email protected] on July 25th, 2002 Vulnerability : KaZaa Denial of Service Attack Tested On : KaZaa v1.7.1 Remote : Yes Fix : KaZaa v1.7.2 has been released and is a fix for the problem Big Thanks To : SooT for letting me crash your system a lot...

CVE-2002-0568

Oracle 9i Application Server stores XSQL and SOAP configuration files insecurely, which allows local users to obtain sensitive information including usernames and passwords by requesting 1 XSQLConfig.xml or 2 soapConfig.xml through a virtual directory...

CVE-2002-0310

Netwin WebNews 1.1k CGI program includes several default usernames and cleartext passwords that cannot be deleted by the administrator, which allows remote attackers to gain privileges via the username/password combinations 1 testweb/newstest, 2 alwn3845/imaptest, 3 alwi3845/wtest3452, or 4...

CVE-2002-0212

The login for Hosting Controller 1.1 through 1.4.1 returns different error messages when a valid or invalid user is provided, which allows remote attackers to determine the existence of valid usernames and makes it easier to conduct a brute force attack...

CVE-2002-0310

Netwin WebNews 1.1k CGI program includes several default usernames and cleartext passwords that cannot be deleted by the administrator, which allows remote attackers to gain privileges via the username/password combinations 1 testweb/newstest, 2 alwn3845/imaptest, 3 alwi3845/wtest3452, or 4...

CVE-2001-1338

Beck IPC GmbH IPC@CHIP TelnetD server generates different responses when given valid and invalid login names, which allows remote attackers to determine accounts on the system...

Nortel CVX 1800s will dump all local user names and passwords via SNMP

The Nortel CVX 1800 is a modem bank containing up to 2600 modems per box. Many ISP's are using them for their dial-up customers. While querying the CVX-1800 for SNMP codes to use in a modem statistics program I was writing, I discovered the CVX-1800 will spill out all user names and passwords in...

Buffer overflows in Sambar

Buffer overflows in long username and in few CGIs...

CVE-2002-1637

Multiple components in Oracle 9i Application Server 9iAS are installed with over 160 default usernames and passwords, including 1 SYS, 2 SYSTEM, 3 AQJAVA, 4 OWA, 5 IMAGEUSER, 6 USER1, 7 USER2, 8 PLSQL, 9 DEMO, 10 FINANCE, and many others, which allows attackers to gain privileges...

Check Point VPN-1 SecuRemote Flaw

Summary: SecuRemote will show whether a username is recognized during failed login attempts Versions Tested: 4.1 SP4 4185 VPN+Strong for Windows 2000 4.1 SP4 4185 VPN+Strong for Windows NT Description: During an authentication attempt in the VPN-1 SecuRemote Authentication dialog box, a failed...

CVE-1999-1266

rsh daemon rshd generates different error messages when a valid username is provided versus an invalid name, which allows remote attackers to determine valid users on the system...

CVE-1999-1344

CVE-1999-1344 affects Auto_FTP 0.2, where Auto_FTP.pl stores usernames and passwords in plaintext in the auto_ftp.conf file. The underlying issue is plaintext credential storage, enabling disclosure of credentials over the network (NVD metric: CVSSv2 v2.0 base score 7.5, HIGH). Exploitation detai...

CVE-2001-1013

Apache on Red Hat Linux with with the UserDir directive enabled generates different error codes when a username exists and there is no publichtml directory and when the username does not exist, which could allow remote attackers to determine valid usernames on the server...

CVE-2001-1068

qpopper 4.01 with PAM based authentication on Red Hat systems generates different error messages when an invalid username is provided instead of a valid name, which allows remote attackers to determine valid usernames on the system...

DynFX POPd Denial of Service Vulnerability

Strumpf Noir Society Advisories ! Public release ! -- -= DynFX POPd Denial of Service Vulnerability =- Release date: Saturday, May 26, 2001 Introduction: DynFX MailServer is an SMTP and POP3 Server package for the WINNT and Win2k platforms. This application is available from vendor DynFX Internet...