CVE-2004-2670

Affected software: eNdonesia 8.3 (publisher module) with mod.php. Vulnerable component/file: mod.php in the publisher module; issue stems from cross-site scripting (XSS) in two input vectors. Payload vectors: (1) mod parameter in a viewcat operation, (2) query parameter in a search operation. Imp...

CVE-2004-2670

Multiple cross-site scripting XSS vulnerabilities in mod.php in eNdonesia 8.3 allow remote attackers to inject arbitrary web script or HTML via 1 the mod parameter in a viewcat operation or 2 the query parameter in a search operation in the publisher module...

CVE-2004-2671

The CVE-2004-2671 entry corresponds to a vulnerability in mod.php of eNdonesia 8.3 where remote attackers can obtain sensitive information by issuing certain direct requests and requests with invalid parameter values. The error messages disclose local paths, demonstrated via the (1) mod and (2) c...

CVE-2004-2668

CVE-2004-2668 : Interchange before 4.8.9 has an SQL injection vulnerability that allows remote attackers to execute arbitrary SQL commands via unknown vectors. Affected software: Interchange (web commerce platform). Root cause: improper handling of user input in SQL queries. Impact: potential una...

CVE-2004-2667

CVE-2004-2667 describes a cross-site scripting (XSS) vulnerability in Lotus Domino 6.0.x before 6.0.4 and 6.5.x before 6.5.2. According to the provided sources, remote attackers could inject arbitrary web script or HTML via unknown attack vectors. The vulnerability is documented across multiple f...

CVE-2004-2668

SQL injection vulnerability in Interchange before 4.8.9 allows remote attackers to execute arbitrary SQL commands via unknown vectors...

CVE-2004-2669

CVE-2004-2669 affects Land Down Under (LDU) v701 and enables multiple SQL injection vectors via PHP parameters: s, w, d in users.php; id in comments.php; rusername in auth.php; h in plug.php. Root cause is unsafely-constructed SQL queries with user input, allowing remote execution of arbitrary SQ...

Quietly tell you how hackers to your system kind of Trojan horse-vulnerability warning-the black bar safety net

I believe that many friends have heard of the Trojans, always feel it is very mysterious, very difficult, but in fact with the Trojan software intelligent, a lot of hackers are able to easily achieve the attack purpose. Today, the author in the latest of a Trojan horse-the black hole 2 0 0 4, fro...

raptor_oraextproc.sql.txt

-- $Id: raptororaextproc.sql,v 1.1 2006/12/19 14:21:00 raptor Exp $ -- -- raptororaextproc.sql - command exec via oracle extproc -- Copyright c 2006 Marco Ivaldi -- -- Directory traversal vulnerability in extproc in Oracle 9i and 10g -- allows remote attackers to access arbitrary libraries outsid...

Oracle <= 9i / 10g (extproc) Local/Remote Command Execution Exploit

No description provided by source. -- -- $Id: raptororaextproc.sql,v 1.1 2006/12/19 14:21:00 raptor Exp $ -- -- raptororaextproc.sql - command exec via oracle extproc -- Copyright c 2006 Marco Ivaldi [email protected] -- -- Directory traversal vulnerability in extproc in Oracle 9i and 10g --...

Oracle 9i/10g - 'extproc' Local/Remote Command Execution

-- -- $Id: raptororaextproc.sql,v 1.1 2006/12/19 14:21:00 raptor Exp $ -- -- raptororaextproc.sql - command exec via oracle extproc -- Copyright c 2006 Marco Ivaldi -- -- Directory traversal vulnerability in extproc in Oracle 9i and 10g -- allows remote attackers to access arbitrary libraries...

Oracle MD2 component SDO_CODE_SIZE buffer overflow

Added: 12/18/2006 CVE: CVE-2004-1774 BID: 10871 OSVDB: 9867 Background Oracle Database is a relational database solution available for multiple platforms. Problem A buffer overflow in the SDOCODESIZE function in the MD2 component of Oracle Database allows remote attackers to execute arbitrary...

Oracle MD2 component SDO_CODE_SIZE buffer overflow

Added: 12/18/2006 CVE: CVE-2004-1774 BID: 10871 OSVDB: 9867 Background Oracle Database is a relational database solution available for multiple platforms. Problem A buffer overflow in the SDOCODESIZE function in the MD2 component of Oracle Database allows remote attackers to execute arbitrary...

CVE-2004-2666

CVE-2004-2666 affects MantisBT before 20041016, where the web interface exposes the full Bug History/Issue History regardless of view_history_threshold. This permits remote attackers who visit a bug page to access private bug details. The provided sources confirm the vulnerability in MantisBT’s h...

Mercantec SoftCart CGI Overflow

This is an exploit for an undisclosed buffer overflow in the SoftCart.exe CGI as shipped with Mercantec's shopping cart software. It is possible to execute arbitrary code by passing a malformed CGI parameter in an HTTP GET request. This issue is known to affect SoftCart version 4.00b. This module...

Squid NTLM Authenticate Overflow

This is an exploit for Squid's NTLM authenticate overflow libntlmssp.c. Due to improper bounds checking in ntlmcheckauth, it is possible to overflow the 'pass' variable on the stack with user controlled data of a user defined length. Props to iDEFENSE for the advisory. This module requires...

Debian DSA-1234-1 : ruby1.6 - denial of service

A denial of service vulnerability has been discovered in the CGI library included with Ruby, the interpreted scripting language for quick and easy object-oriented programming. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracte...

JustSystems多个产品未明缓冲区溢出漏洞

Justsystem公司包含多个设计通用软件产品。 Justsystem多个产品在处理文档时存在缓冲区溢出攻击，远程攻击者可以利用漏洞以应用程序进程权限执行任意指令。 目前没有详细漏洞细节提供。 Justsystem Sanshiro 2005 Justsystem Ichitaro viewer 4.0 Justsystem Ichitaro Lite2 R2 Justsystem Ichitaro Lite2 0 Justsystem Ichitaro 2006 Justsystem Ichitaro 2005 Justsystem Ichitaro 0 Justsystem...

JVN#47272891 Hanako buffer overflow vulnerability

Impact An arbitrary code could be executed on the PCs of Hanako user, if the user opens a specially crafted Hanako file sent by a remote attacker. Solution Products Affected Hanako 2004 Hanako 2005 Hanako 2006 Hanako Viewer 1.0 For more information, refer to the vendor's website...

CVE-2006-6153

Multiple cross-site scripting XSS vulnerabilities in vSpin.net Classified System 2004 allow remote attackers to inject arbitrary web script or HTML via 1 catname parameter to cat.asp or the 2 minprice parameter to search.asp...