ProFTPD Login Timing Account Name Enumeration

The remote ProFTPd server is as old or older than 1.2.10 It is possible to determine which user names are valid on the remote host based on timing analysis attack of the login procedure. An attacker may use this flaw to set up a list of valid usernames for a more efficient brute-force attack...

ProFTPd 1.2.10 - Remote Users Enumeration

/ Details Vulnerable Systems: ProFTPD Version 1.2.10 and below It is possible to determine which user names are valid, which are special, and which ones do not exist on the remote system. This can be accomplished by code execution path timing analysis attack at the ProFTPd login procedure. There ...

ProFTPd 1.2.10 - Remote Users Enumeration

ProFTPd 1.2.10 - Remote Users Enumeration / Details Vulnerable Systems: ProFTPD Version 1.2.10 and below It is possible to determine which user names are valid, which are special, and which ones do not exist on the remote system. This can be accomplished by code execution path timing analysis...

phpMyWebhosting - SQL Injection

phpMyWebhosting - SQL Injection !/usr/bin/perl Exploit code by Noam Rathaus of Beyond Security Ltd. The following exploit code will use a valid username and password combination, to cause an SQL injection. Using the SQL injection, the Perl script elevates the privileges of the user provided to...

EasyWeb 1.0 FileManager Module - Directory Traversal

source: https://www.securityfocus.com/bid/10792/info EasyWeb is prone to a directory traversal vulnerability. This issue presents itself due to insufficient sanitization of user-supplied data. The issue occurs if a remote attacker sends a request to the 'ewfilemanager' script for a file containin...

EasyWeb 1.0 FileManager Module - Directory Traversal

EasyWeb 1.0 FileManager Module - Directory Traversal source: https://www.securityfocus.com/bid/10792/info EasyWeb is prone to a directory traversal vulnerability. This issue presents itself due to insufficient sanitization of user-supplied data. The issue occurs if a remote attacker sends a reque...

RhinoSoft Serv-U FTPd Server 3/4/5 - 'MDTM' Time Argument Buffer Overflow (3)

// source: https://www.securityfocus.com/bid/9751/info Serv-U FTP Server has been reported prone to a remote stack based buffer overflow vulnerability when handling time zone arguments passed to the MDTM FTP command. The problem exists due to insufficient bounds checking. Ultimately an attacker m...

RhinoSoft Serv-U FTPd Server 3/4/5 - 'MDTM' Time Argument Buffer Overflow (2)

// source: https://www.securityfocus.com/bid/9751/info Serv-U FTP Server has been reported prone to a remote stack based buffer overflow vulnerability when handling time zone arguments passed to the MDTM FTP command. The problem exists due to insufficient bounds checking. Ultimately an attacker m...

CVE-2004-0042

vsftpd 1.1.3 generates different error messages depending on whether or not a valid username exists, which allows remote attackers to identify valid usernames...

CVE-2004-0044

Cisco Personal Assistant 1.41 and 1.42 disables password authentication when "Allow Only Cisco CallManager Users" is enabled and the Corporate Directory settings refer to the directory service being used by Cisco CallManager, which allows remote attackers to gain access with a valid username...

CVE-2004-0042

vsftpd 1.1.3 generates different error messages depending on whether or not a valid username exists, which allows remote attackers to identify valid usernames...

RhinoSoft Serv-U FTPd Server 3.x4.x - SITE CHMOD Remote Overflow

RhinoSoft Serv-U FTPd Server 3.x4.x - SITE CHMOD Remote Overflow / ----------------------------------------------------------------------- Servu.c - Serv-U FTPD 3.x/4.x "SITE CHMOD" Command Remote stack buffer overflow exploit Copyright C 2004 HUC All Rights Reserved. Author : lion :...

RhinoSoft Serv-U FTPd Server 3.x/4.x - 'SITE CHMOD' Remote Overflow

/ ----------------------------------------------------------------------- Servu.c - Serv-U FTPD 3.x/4.x "SITE CHMOD" Command Remote stack buffer overflow exploit Copyright C 2004 HUC All Rights Reserved. Author : lion : [email protected] : http://www.cnhonker.com Date : 2004-01-25 : 2004-01-25 v1...

CVE-2004-0042

vsftpd 1.1.3 generates different error messages depending on whether or not a valid username exists, which allows remote attackers to identify valid usernames...

GnuPG creates ElGamal keys for signing using insufficient entropy

Overview Gnu Privacy Guard GnuPG is a cryptographic utility used to generate cryptographic keys and perform other cryptographic functions. A vulnerability in the way GnuPG generates ElGamal keys has been discovered. This vulnerability renders ElGamal signing key untrustworthy. Description A...

GtkFtpd 1.0.4 Remote Root Buffer Overflow Exploit

No description provided by source. / gtkftpdv1.0.4and below: remote root buffer overflow exploit. by: vade79/v9 v9 at fakehalo.deadpig.org fakehalo/realhalo Url: http://gtkftpd.sourceforge.net/ GtkFtpd, versions v1.0.4 and belowas of this time, contain a remotely exploitable buffer overflow. the...

GtkFtpd 1.0.4 Remote Root Buffer Overflow Exploit

Exploit for linux platform in category remote exploits ================================================= GtkFtpd 1.0.4 Remote Root Buffer Overflow Exploit ================================================= / gtkftpdv1.0.4and below: remote root buffer overflow exploit. by: vade79/v9 v9 at...

MDaemon SMTP Server 5.0.5 - Null Password Authentication

MDaemon SMTP Server 5.0.5 - Null Password Authentication source: https://www.securityfocus.com/bid/8382/info A vulnerability has been reported to affect the MDaemon SMTP authentication handler. It has been reported that any valid username or account can be used in conjunction with a null password...

Cisco Aironet AP1100 Valid Account Disclosure Vulnerability

VIGILANTe Security Watch Advisory Name: Cisco Aironet AP1100 Valid Account Disclosure Vulnerability Systems Affected: Tested on a Cisco Aironet AP1100 Model 1120B Series Wireless device. Firmware version 12.24JA and earlier. NB : A large number of Cisco IOSes are affected by this flaw. Severity:...

CVE-2003-0512

Cisco IOS 12.2 and earlier generates a "% Login invalid" message instead of prompting for a password when an invalid username is provided, which allows remote attackers to identify valid usernames on the system and conduct brute force password guessing, as reported for the Aironet Bridge...