DUportal 3.1.2 - 'inc_poll_voting.asp?DAT_PARENT' SQL Injection

source: https://www.securityfocus.com/bid/13288/info DUportal/DUportal SQL are prone to multiple SQL injection vulnerabilities. These issues exist because the application fails to properly sanitize user-supplied input before using it in SQL queries. Successful exploitation could result in a...

[AppSecInc Team SHATTER Security Advisory] SQL Injection in CREATE_SCN_CHANGE_SET procedure

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 SQL Injection in CREATESCNCHANGESET procedure AppSecInc Team SHATTER Security Advisory http://www.appsecinc.com/resources/alerts/oracle/2005-05.html April 18, 2005 Affected versions: Oracle Database Server version 10g Risk level: High Credits: This...

[AppSecInc Team SHATTER Security Advisory] Denial of Service in Oracle interMedia

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Denial of Service in Oracle interMedia AppSecInc Team SHATTER Security Advisory http://www.appsecinc.com/resources/alerts/oracle/2005-01.html April 18, 2005 Affected versions: Oracle Database Server versions 9i and 10g Risk level: Medium Credits: This...

[AppSecInc Team SHATTER Security Advisory] Multiple SQL Injection vulnerabilities in DBMS_METADATA package

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Multiple SQL Injection vulnerabilities in DBMSMETADATA package AppSecInc Team SHATTER Security Advisory http://www.appsecinc.com/resources/alerts/oracle/2005-03.html April 18, 2005 Affected Versions: Oracle Database Server versions 9i and 10g Risk...

CVE-2005-1136

CVE-2005-1136 affects Simple PHP Blog (sphpBlog) 0.4.0. The vulnerability arises because the application stores (1) password.txt and (2) config.txt under the web document root, enabling remote attackers to obtain sensitive information by direct requests to these files. This could facilitate passw...

Arbitrary file overwrite possible by Musicmatch ActiveX control

Hyperdose Security Advisory Name: Arbitrary file overwrite in Musicmatch Systems Affected: Musicmatch v10.00.2047 or earlier according to Yahoo v9.00.5059 and earlier are also affected Severity: Important Author: Robert Fly - [email protected] Advisory URL:...

Trojan file issue in Musicmatch software

Hyperdose Security Advisory Name: Arbitrary file overwrite in Musicmatch Systems Affected: Musicmatch v10.00.2047 or earlier according to Yahoo v9.00.5059 and earlier are also affected Severity: Moderate Author: Robert Fly - [email protected] Advisory URL:...

BitComet 0.57 Local Proxy Password Disclosure Exploit

No description provided by source. / BitComet 0.57 Local Proxy Password Disclosure Exploit by Kozan Application: BitComet 0.57 and probably prior versions Vendor:www.bitcomet.com Vulnerable Description: BitComet 0.57 discloses proxy passwords to local users. Discovered & Coded by: Kozan Credits t...

ModernGigabyte ModernBill 4.3 - 'Aid' Cross-Site Scripting

source: https://www.securityfocus.com/bid/13089/info ModernBill is affected by a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input to the 'aid' parameter. This may facilitate the theft of cookie-based authentication...

InterAKT Online MX Shop 1.1.1 - SQL Injection

InterAKT Online MX Shop 1.1.1 - SQL Injection source: https://www.securityfocus.com/bid/12957/info MX Shop is reportedly affected by an SQL-injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in SQL queries. This...

ESMI PayPal StoreFront 1.7 - products1.php?id2 SQL Injection

ESMI PayPal StoreFront 1.7 - products1.php?id2 SQL Injection source: https://www.securityfocus.com/bid/12903/info ESMI PayPal Storefront is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in as SQL...

DigitalHive 2.0 - membres.php?mt Cross-Site Scripting

DigitalHive 2.0 - membres.php?mt Cross-Site Scripting source: https://www.securityfocus.com/bid/12883/info DigitalHive is reportedly affected by a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. An attacker may levera...

RunCMS 1.1 - Database Configuration Information Disclosure

source: https://www.securityfocus.com/bid/12848/info RunCMS is reportedly affected by an information disclosure vulnerability. This issue is due to a failure in the application to secure sensitive information. Exploitation of this vulnerability could lead to the disclosure of database configurati...

[SECURITYREASON.COM] SQL injection and XSS in paFileDB

-= SecurityReason-2005-SRA03 =- -= SQL injection and XSS in paFileDB =- Author: sp3x Date: 12 March 2005 Affected software : =================== paFileDB version : =3.1 Description : ============= paFileDB is designed to allow webmasters have a database of files for download on their site. To add...

PHP, ASP, CGI web applications security vulnerabilities

PHP inclusions, SQL injections, directory traversals, crossite scripting, etc...

Stadtaus.Com Download Center Lite 1.5 - PHP Remote File Inclusion

Stadtaus.Com Download Center Lite 1.5 - PHP Remote File Inclusion source: https://www.securityfocus.com/bid/12726/info Download Center Lite is reportedly affected by an arbitrary remote PHP file include vulnerability. This issue is due to the application failing to properly sanitize user supplied...

DCP-Portal 6.1.1 - Multiple SQL Injections

source: https://www.securityfocus.com/bid/12573/info DCP-Portal is reportedly affected by multiple SQL injection vulnerabilities. These issues exist because the application fails to properly sanitize user-supplied input before using it in SQL queries. Successful exploitation could result in a...

PHP/ASP/CGI web applications security bugs

PHP inclusions, SQL injections, directory traversals, crossite scripting, etc...

Captaris Infinite Mobile Delivery Webmail 2.6 - Full Path Disclosure

Captaris Infinite Mobile Delivery Webmail 2.6 - Full Path Disclosure source: https://www.securityfocus.com/bid/12399/info Infinite Mobile Delivery Webmail is reportedly affected by a path disclosure vulnerability. This issue could permit a malicious user to expose the root path of the affected...

Horde < 3.0.1 Multiple Script XSS

The remote host is running at least one instance of Horde version 3.0, which suffers from two cross-site scripting vulnerabilities. Through specially crafted GET requests to the remote host, an attacker can cause a third-party user to unknowingly run arbitrary JavaScript code. %NASLMINLEVEL 70300...