Oracle Secure Backup Administration Server Command Injection (CVE-2009-1978)

Oracle Secure Backup is a backup solution allowing for centralized tape backup management. The vulnerability is due to a flaw in the logic used to authenticate a user to the administration server. Successful exploitation of this vulnerability allows remote attackers to bypass authentication on...

Oracle Secure Backup Authentication Bypass/Command Injection Vulnerability

This module exploits an authentication bypass vulnerability in login.php in order to execute arbitrary code via a command injection vulnerability in propertybox.php. This module was tested against Oracle Secure Backup version 10.3.0.1.0 Win32. This module requires Metasploit:...

Oracle Secure Backup Server 10.3.0.1.0 Auth Bypass/RCI Exploit

No description provided by source. !/bin/bash Oracle Secure Backup Administration Server authentication bypass, plus command injection vulnerability 1-day exploit for CVE-2009-1977 and CVE-2009-1978 PoC script successfully tested on: Oracle Secure Backup Server 10.3.0.1.0win32release MS Windows...

Oracle Secure Backup Server Bypass / Command Injection

!/bin/bash Oracle Secure Backup Administration Server authentication bypass, plus command injection vulnerability 1-day exploit for CVE-2009-1977 and CVE-2009-1978 PoC script successfully tested on: Oracle Secure Backup Server 10.3.0.1.0win32release MS Windows Professional XP SP3 In August 2009,...

Oracle Secure Backup Server 10.3.0.1.0 Auth Bypass/RCI Exploit

Exploit for windows platform in category remote exploits ============================================================== Oracle Secure Backup Server 10.3.0.1.0 Auth Bypass/RCI Exploit ============================================================== !/bin/bash Oracle Secure Backup Administration Serv...

Oracle Secure Backup Server 10.3.0.1.0 - Authentication Bypass Remote Code Injection

Oracle Secure Backup Server 10.3.0.1.0 - Authentication Bypass Remote Code Injection !/bin/bash Oracle Secure Backup Administration Server authentication bypass, plus command injection vulnerability 1-day exploit for CVE-2009-1977 and CVE-2009-1978 PoC script successfully tested on: Oracle Secure...

CVE-2009-1978

creationtimestamp| type| source ---|---|--- 2009-09-14 00:00:00+00:00| confirmed| https://www.exploit-db.com/exploits/9652 2018-05-29 15:50:33+00:00| seen| https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/admin/oracle/osbexecqr2.rb 2025-02-06 03:13:39+00:00| seen|...

Oracle Secure Backup Server 10.3.0.1.0 - Authentication Bypass / Remote Code Injection

!/bin/bash Oracle Secure Backup Administration Server authentication bypass, plus command injection vulnerability 1-day exploit for CVE-2009-1977 and CVE-2009-1978 PoC script successfully tested on: Oracle Secure Backup Server 10.3.0.1.0win32release MS Windows Professional XP SP3 In August 2009,...

Oracle Secure Backup property_box.php type parameter command execution

Added: 09/01/2009 CVE: CVE-2009-1978 BID: 35678 OSVDB: 55904 Background Oracle Secure Backup is a centralized tape backup management solution for Oracle Database. Problem A command execution vulnerability in the Oracle Secure Backup web interface allows remote attackers to execute arbitrary...

Oracle Secure Backup property_box.php type parameter command execution

Added: 09/01/2009 CVE: CVE-2009-1978 BID: 35678 OSVDB: 55904 Background Oracle Secure Backup is a centralized tape backup management solution for Oracle Database. Problem A command execution vulnerability in the Oracle Secure Backup web interface allows remote attackers to execute arbitrary...

DSquare Exploit Pack: D2SEC_ORA_SECBACK2

Name| d2secorasecback2 ---|--- CVE| CVE-2009-1978 Exploit Pack| D2ExploitPack Description| Oracle Secure Backup Arbitrary Command Execution Vulnerability Notes|...

CVE-2009-1978

CVE-2009-1978 affects Oracle Secure Backup (Administration Server component). The vulnerability enables remote code execution with SYSTEM privileges via vectors involving property_box.php, impacting Oracle Secure Backup 10.2.0.3 (and related 10.3.0.1.0 deployments) as noted in the July 2009 Oracl...

CVE-2008-1978

The CVE-2008-1978 entry describes an XSS vulnerability in the Ubercart 5.x for Drupal, specifically in the Ubercart 5.x before 5.x-1.0 rc3 module. The issue allows remote authenticated users to inject arbitrary web script or HTML via node titles related to unspecified product features (a vector d...

SuSE 10 Security Update : heartbeat (ZYPP Patch Number 1978)

This update fixes both a local and a remote denial of service attack within heartbeat, as well as numerous other bugs in the messaging and membership layer, GUI, Cluster Resource Manager, Local Resource Manager and Resource Agents. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text...

CVE-2007-1978

SQL injection vulnerability in index.php in the Arcade 1.00 module for PHP-Fusion allows remote attackers to execute arbitrary SQL commands via the cid parameter in a viewgamelist action...

CVE-2007-1978

CVE-2007-1978 : SQL injection in the Arcade 1.00 module for PHP-Fusion (index.php, view_game_list action) allows remote attackers to inject arbitrary SQL via the cid parameter. Root cause is unsanitized input leading to database query manipulation. Documents do not provide explicit patch version ...

CVE-2006-1978

SQL injection vulnerability in inc/start.php in FlexBB 0.5.5 and earlier allows remote attackers to execute arbitrary SQL commands via the flexbbusername COOKIE parameter...

CVE-2006-1978

The vulnerability CVE-2006-1978 affects FlexBB 0.5.5 and earlier, due to an SQL injection in inc/start.php. An attacker can manipulate the flexbb_username cookie to execute arbitrary SQL commands on the backend. This is a remote attack with no authentication required, and the impact includes pote...

CVE-2005-1978

COM+ in Microsoft Windows does not properly "create and use memory structures," which allows local users or remote attackers to execute arbitrary code...

CVE-2005-1978

CAN-2005-1978 pertains to a COM+ vulnerability in Windows (MS04-era MS05-051 context) where the COM+ component creates/uses memory structures in a way that could allow remote code execution and local privilege escalation. The linked MS05-051 bulletin confirms affected platforms include Windows 20...