< Back to JetLib.com

jetlib.sec » Tags » authentication-credentials

« Expand/Collapse

23 items tagged "authentication credentials"

Related tags: server [+], red hat security [+], red hat network [+], wampserver [+], virtual network computing [+], user [+], tivoli endpoint [+], tivoli [+], site [+], security [+], performance mail [+], machine architectures [+], linux deployments [+], jboss enterprise application platform [+], ibm [+], endpoint [+], cyrus imapd [+], cross site scripting [+], cross [+], based buffer overflow [+], vncviewer [+], jboss [+], web [+], vmdirect [+], url [+], tool [+], ssh ftp [+], read [+], nix [+], hacking [+], external server [+], brute forcer [+], brute [+], Tools [+], red [+], hat [+]

February 16, 2012
19:04
WampServer 2.2c Cross Site Scripting
» ‎ Packet Storm Security Exploits

WampServer is vulnerable to cross site scripting vulnerability. This issue is due to the application's failure to properly sanitize user-supplied input thru the 'lang' parameter (GET) in index.php script. An attacker may leverage any of the cross site scripting issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials, phishing as well as other attacks.
Tags: cross wampserver site authentication-credentials cross-site-scripting

19:04
WampServer 2.2c Cross Site Scripting
» ‎ Packet Storm Security Recent Files

WampServer is vulnerable to cross site scripting vulnerability. This issue is due to the application's failure to properly sanitize user-supplied input thru the 'lang' parameter (GET) in index.php script. An attacker may leverage any of the cross site scripting issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials, phishing as well as other attacks.
Tags: cross wampserver site authentication-credentials cross-site-scripting

19:04
WampServer 2.2c Cross Site Scripting
» ‎ Packet Storm Security Misc. Files

WampServer is vulnerable to cross site scripting vulnerability. This issue is due to the application's failure to properly sanitize user-supplied input thru the 'lang' parameter (GET) in index.php script. An attacker may leverage any of the cross site scripting issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials, phishing as well as other attacks.
Tags: cross wampserver site authentication-credentials cross-site-scripting

February 09, 2012
23:46
Red Hat Security Advisory 2012-0108-01
» ‎ Packet Storm Security Advisories

Red Hat Security Advisory 2012-0108-01 - JBoss Cache is the clustering backbone for data distribution in JBoss Enterprise Application Platform. It provides the backing implementation for web session replication, stateful session bean replication and entity caching. It was found that NonManagedConnectionFactory would log the username and password in plain text when an exception was thrown. This could lead to the exposure of authentication credentials if local users had permissions to read the log file. Warning: Before applying this update, back up your existing JBoss Enterprise Application Platform's "jboss-as/server/[PROFILE]/lib/jbosscache-core.jar" file.
Tags: jboss hat red jboss-enterprise-application-platform authentication-credentials red-hat-security

23:46
Red Hat Security Advisory 2012-0108-01
» ‎ Packet Storm Security Recent Files

Red Hat Security Advisory 2012-0108-01 - JBoss Cache is the clustering backbone for data distribution in JBoss Enterprise Application Platform. It provides the backing implementation for web session replication, stateful session bean replication and entity caching. It was found that NonManagedConnectionFactory would log the username and password in plain text when an exception was thrown. This could lead to the exposure of authentication credentials if local users had permissions to read the log file. Warning: Before applying this update, back up your existing JBoss Enterprise Application Platform's "jboss-as/server/[PROFILE]/lib/jbosscache-core.jar" file.
Tags: jboss hat red jboss-enterprise-application-platform authentication-credentials red-hat-security

23:46
Red Hat Security Advisory 2012-0108-01
» ‎ Packet Storm Security Misc. Files

Red Hat Security Advisory 2012-0108-01 - JBoss Cache is the clustering backbone for data distribution in JBoss Enterprise Application Platform. It provides the backing implementation for web session replication, stateful session bean replication and entity caching. It was found that NonManagedConnectionFactory would log the username and password in plain text when an exception was thrown. This could lead to the exposure of authentication credentials if local users had permissions to read the log file. Warning: Before applying this update, back up your existing JBoss Enterprise Application Platform's "jboss-as/server/[PROFILE]/lib/jbosscache-core.jar" file.
Tags: jboss-enterprise-application-platform authentication-credentials red-hat-security

February 06, 2012
16:13
Red Hat Security Advisory 2012-0101-01
» ‎ Packet Storm Security Advisories

Red Hat Security Advisory 2012-0101-01 - Red Hat Network Satellite is a systems management tool for Linux-based infrastructures. It allows for provisioning, monitoring, and remote management of multiple Linux deployments with a single, centralized tool. If a user submitted a system registration XML-RPC call to an RHN Satellite server and that call failed, their RHN user password was included in plain text in the error messages both stored in the server log and mailed to the server administrator. With this update, user passwords are excluded from these error messages to avoid the exposure of authentication credentials.
Tags: user hat red red-hat-network linux-deployments authentication-credentials

16:13
Red Hat Security Advisory 2012-0101-01
» ‎ Packet Storm Security Recent Files

Red Hat Security Advisory 2012-0101-01 - Red Hat Network Satellite is a systems management tool for Linux-based infrastructures. It allows for provisioning, monitoring, and remote management of multiple Linux deployments with a single, centralized tool. If a user submitted a system registration XML-RPC call to an RHN Satellite server and that call failed, their RHN user password was included in plain text in the error messages both stored in the server log and mailed to the server administrator. With this update, user passwords are excluded from these error messages to avoid the exposure of authentication credentials.
Tags: user hat red red-hat-network linux-deployments authentication-credentials

16:13
Red Hat Security Advisory 2012-0101-01
» ‎ Packet Storm Security Misc. Files

Red Hat Security Advisory 2012-0101-01 - Red Hat Network Satellite is a systems management tool for Linux-based infrastructures. It allows for provisioning, monitoring, and remote management of multiple Linux deployments with a single, centralized tool. If a user submitted a system registration XML-RPC call to an RHN Satellite server and that call failed, their RHN user password was included in plain text in the error messages both stored in the server log and mailed to the server administrator. With this update, user passwords are excluded from these error messages to avoid the exposure of authentication credentials.
Tags: user hat red red-hat-network linux-deployments authentication-credentials

16:10
Red Hat Security Advisory 2012-0102-01
» ‎ Packet Storm Security Advisories

Red Hat Security Advisory 2012-0102-01 - Red Hat Network Proxy provides a mechanism for caching content, such as package updates from Red Hat or custom content created for an organization on an internal, centrally-located server. If a user submitted a system registration XML-RPC call to an RHN Proxy server and that call failed, their RHN user password was included in plain text in the error messages both stored in the server log and mailed to the server administrator. With this update, user passwords are excluded from these error messages to avoid the exposure of authentication credentials.
Tags: server hat red red-hat-network red-hat-security authentication-credentials

16:10
Red Hat Security Advisory 2012-0102-01
» ‎ Packet Storm Security Recent Files

Red Hat Security Advisory 2012-0102-01 - Red Hat Network Proxy provides a mechanism for caching content, such as package updates from Red Hat or custom content created for an organization on an internal, centrally-located server. If a user submitted a system registration XML-RPC call to an RHN Proxy server and that call failed, their RHN user password was included in plain text in the error messages both stored in the server log and mailed to the server administrator. With this update, user passwords are excluded from these error messages to avoid the exposure of authentication credentials.
Tags: server hat red red-hat-network red-hat-security authentication-credentials

16:10
Red Hat Security Advisory 2012-0102-01
» ‎ Packet Storm Security Misc. Files

Red Hat Security Advisory 2012-0102-01 - Red Hat Network Proxy provides a mechanism for caching content, such as package updates from Red Hat or custom content created for an organization on an internal, centrally-located server. If a user submitted a system registration XML-RPC call to an RHN Proxy server and that call failed, their RHN user password was included in plain text in the error messages both stored in the server log and mailed to the server administrator. With this update, user passwords are excluded from these error messages to avoid the exposure of authentication credentials.
Tags: server hat red red-hat-network red-hat-security authentication-credentials

June 15, 2011
5:32
Red Hat Security Advisory 2011-0871-01
» ‎ Packet Storm Security Advisories

Red Hat Security Advisory 2011-0871-01 - Virtual Network Computing is a remote display system which allows you to view a computer's desktop environment not only on the machine where it is running, but from anywhere on the Internet and from a wide variety of machine architectures. TigerVNC is a suite of VNC servers and clients. It was discovered that vncviewer could prompt for and send authentication credentials to a remote server without first properly validating the server's X.509 certificate. As vncviewer did not indicate that the certificate was bad or missing, a man-in-the-middle attacker could use this flaw to trick a vncviewer client into connecting to a spoofed VNC server, allowing the attacker to obtain the client's credentials. Various other issues were also addressed.
Tags: server red vncviewer virtual-network-computing machine-architectures authentication-credentials

5:32
Red Hat Security Advisory 2011-0871-01
» ‎ Packet Storm Security Recent Files

Red Hat Security Advisory 2011-0871-01 - Virtual Network Computing is a remote display system which allows you to view a computer's desktop environment not only on the machine where it is running, but from anywhere on the Internet and from a wide variety of machine architectures. TigerVNC is a suite of VNC servers and clients. It was discovered that vncviewer could prompt for and send authentication credentials to a remote server without first properly validating the server's X.509 certificate. As vncviewer did not indicate that the certificate was bad or missing, a man-in-the-middle attacker could use this flaw to trick a vncviewer client into connecting to a spoofed VNC server, allowing the attacker to obtain the client's credentials. Various other issues were also addressed.
Tags: server red vncviewer virtual-network-computing machine-architectures authentication-credentials

5:32
Red Hat Security Advisory 2011-0871-01
» ‎ Packet Storm Security Misc. Files

Red Hat Security Advisory 2011-0871-01 - Virtual Network Computing is a remote display system which allows you to view a computer's desktop environment not only on the machine where it is running, but from anywhere on the Internet and from a wide variety of machine architectures. TigerVNC is a suite of VNC servers and clients. It was discovered that vncviewer could prompt for and send authentication credentials to a remote server without first properly validating the server's X.509 certificate. As vncviewer did not indicate that the certificate was bad or missing, a man-in-the-middle attacker could use this flaw to trick a vncviewer client into connecting to a spoofed VNC server, allowing the attacker to obtain the client's credentials. Various other issues were also addressed.
Tags: virtual-network-computing machine-architectures authentication-credentials

June 08, 2011
17:40
Red Hat Security Advisory 2011-0859
» ‎ Packet Storm Security Advisories

Red Hat Security Advisory 2011-0859 - The cyrus-imapd packages contain a high-performance mail server with IMAP, POP3, NNTP, and Sieve support. It was discovered that cyrus-imapd did not flush the received commands buffer after switching to TLS encryption for IMAP, LMTP, NNTP, and POP3 sessions. A man-in-the-middle attacker could use this flaw to inject protocol commands into a victim's TLS session initialization messages. This could lead to those commands being processed by cyrus-imapd, potentially allowing the attacker to steal the victim's mail or authentication credentials. Various other issues were also addressed.
Tags: hat red security cyrus-imapd performance-mail authentication-credentials

17:40
Red Hat Security Advisory 2011-0859
» ‎ Packet Storm Security Recent Files

Red Hat Security Advisory 2011-0859 - The cyrus-imapd packages contain a high-performance mail server with IMAP, POP3, NNTP, and Sieve support. It was discovered that cyrus-imapd did not flush the received commands buffer after switching to TLS encryption for IMAP, LMTP, NNTP, and POP3 sessions. A man-in-the-middle attacker could use this flaw to inject protocol commands into a victim's TLS session initialization messages. This could lead to those commands being processed by cyrus-imapd, potentially allowing the attacker to steal the victim's mail or authentication credentials. Various other issues were also addressed.
Tags: hat red security cyrus-imapd performance-mail authentication-credentials

17:40
Red Hat Security Advisory 2011-0859
» ‎ Packet Storm Security Misc. Files

Red Hat Security Advisory 2011-0859 - The cyrus-imapd packages contain a high-performance mail server with IMAP, POP3, NNTP, and Sieve support. It was discovered that cyrus-imapd did not flush the received commands buffer after switching to TLS encryption for IMAP, LMTP, NNTP, and POP3 sessions. A man-in-the-middle attacker could use this flaw to inject protocol commands into a victim's TLS session initialization messages. This could lead to those commands being processed by cyrus-imapd, potentially allowing the attacker to steal the victim's mail or authentication credentials. Various other issues were also addressed.
Tags: hat red security cyrus-imapd performance-mail authentication-credentials

June 06, 2011
20:08
IBM Tivoli Endpoint 4.1.1 Buffer Overflow / Hard-Coded Credentials
» ‎ Packet Storm Security Exploits

IBM Tivoli Endpoint version 4.1.1 remote SYSTEM exploit that leverages hard-coded base64 encoded authentication credentials in lcfd.exe and a stack-based buffer overflow when parsing HTTP variable values. Spawns a reverse shell to port 4444.
Tags: endpoint ibm tivoli based-buffer-overflow tivoli-endpoint authentication-credentials

20:08
IBM Tivoli Endpoint 4.1.1 Buffer Overflow / Hard-Coded Credentials
» ‎ Packet Storm Security Recent Files

IBM Tivoli Endpoint version 4.1.1 remote SYSTEM exploit that leverages hard-coded base64 encoded authentication credentials in lcfd.exe and a stack-based buffer overflow when parsing HTTP variable values. Spawns a reverse shell to port 4444.
Tags: endpoint ibm tivoli based-buffer-overflow tivoli-endpoint authentication-credentials

20:08
IBM Tivoli Endpoint 4.1.1 Buffer Overflow / Hard-Coded Credentials
» ‎ Packet Storm Security Misc. Files

IBM Tivoli Endpoint version 4.1.1 remote SYSTEM exploit that leverages hard-coded base64 encoded authentication credentials in lcfd.exe and a stack-based buffer overflow when parsing HTTP variable values. Spawns a reverse shell to port 4444.
Tags: endpoint ibm tivoli based-buffer-overflow tivoli-endpoint authentication-credentials

February 01, 2011
1:17
NiX Brute Force – Parallel Log-in Brute Forcing/Password Cracking Tool
» ‎ Darknet

NiX Brute Forcer is a tool that uses brute force in parallel to log into a system without having authentication credentials beforehand. This tool is intended to demonstrate the importance of choosing strong passwords. The goal of NiX is to support a variety of services that allow remote authentication such as: MySQL, SSH, FTP, IMAP. [...]

Read the full post at darknet.org.uk

Tags: tool brute nix read authentication-credentials brute-forcer ssh-ftp hacking Tools

March 31, 2010
21:00
TWSL2010-002.txt
» ‎ Packet Storm Security Advisories

The Struts-based web application uses the server-side session sattribute context_vmdirect to store various settings, including the URL to the XML web service backend. By default, the URL is http://localhost/sdk, but the web service URL can be manually set from a client browser in several locations. If wsUrl is changed to point at an external server, all SOAP calls for that session are sent to the specified server. This includes plaintext authentication credentials. An attacker could exploit this by tricking a user into following a link to /ui/vmDirect.do, with an attacker-controlled server passed in the view parameter.
Tags: url server web authentication-credentials vmdirect external-server