ASP-Rider - SQL Injection

ASP-Rider - SQL Injection source: https://www.securityfocus.com/bid/11933/info A remote SQL injection vulnerability reportedly affects ASP-Rider Web blog. This issue is due to a failure of the application to properly sanitize user-supplied input prior to including it in SQL queries. An attacker m...

mp-invision.txt

SQL-injection in Invision Power Board 2.x MaxPatrol Security Advisory 11.18.04 November 18, 2004 Release Date: November 18, 2004 Date Reported: November 12, 2004 Severity: High Application: Invision Power Board v2.x Affects versions: IPB 2.0.0, IPB 2.0.1 and IPB 2.0.2. Platform: PHP I. DESCRIPTIO...

bBlog rss.php p Parameter SQL Injection

The remote server runs a version of bBlog, a blogging system written in PHP and released under the GPL, which is as old as or older than version 0.7.4. The remote version of this software is affected by a SQL injection attack in the script 'rss.php'. This issue is due to a failure of the...

Computer Associates Unicenter default password

Database access password is stored in installation batch files as cleartext...

Debian DSA-428-1 : slocate - buffer overflow

A vulnerability was discovered in slocate, a program to index and search for files, whereby a specially crafted database could overflow a heap-based buffer. This vulnerability could be exploited by a local attacker to gain the privileges of the 'slocate' group, which can access the global databas...

PD9 MegaBBS Multiple Vulnerabilities

The remote host is running MegaBBS, a web-based bulletin board system written in ASP. The remote version of this software is vulnerable to a SQL injection attack due to a lack of sanitization of user-supplied input. An attacker may exploit this flaw to issue arbitrary statements in the remote...

Remository - SQL Injection

Remository - SQL Injection source: https://www.securityfocus.com/bid/11219/info It is reported that the ReMOSitory module for Mambo is prone to an SQL injection vulnerability. This issue is due to a failure of the module to properly validate user supplied URI input. Because of this, a malicious...

GetSolutions GetInternet - Multiple SQL Injections

source: https://www.securityfocus.com/bid/11150/info getInternet is vulnerable to multiple remote SQL injection vulnerabilities in the 'welcome.asp', 'checklogin.asp', and 'lostpassword.asp' scripts. These issues are due to a failure of the application to properly validate user-supplied input pri...

GetSolutions GetInternet - Multiple SQL Injections

GetSolutions GetInternet - Multiple SQL Injections source: https://www.securityfocus.com/bid/11150/info getInternet is vulnerable to multiple remote SQL injection vulnerabilities in the 'welcome.asp', 'checklogin.asp', and 'lostpassword.asp' scripts. These issues are due to a failure of the...

CVE-2002-1260

The Java Database Connectivity JDBC APIs in Microsoft Virtual Machine VM 5.0.3805 and earlier allow remote attackers to bypass security checks and access database contents via an untrusted Java applet...

CVE-2002-1260

The CVE-2002-1260 vulnerability affects Microsoft Virtual Machine (VM) 5.0.3805 and earlier, where the JDBC APIs can be exploited by an untrusted Java applet to bypass security checks and access database contents. This is a remote, network‑vector issue that allows partial confidentiality/integrit...

CVE-2002-1479

Cacti before 0.6.8 stores a MySQL username and password in plaintext in config.php, which has world-readable permissions, which allows local users to modify databases as the Cacti user and possibly gain privileges...

CVE-2002-1479

Cacti before 0.6.8 stores a MySQL username and password in plaintext in config.php, which has world-readable permissions, which allows local users to modify databases as the Cacti user and possibly gain privileges...

TorrentTrader 1.0 RC2 - SQL Injection

!/usr/bin/php ? / TorrentTrader 1.0 RC2 SQL Injection Proof of Concept By aCiDBiTS acidbitsathotmail.com 31-August-2004 "TorrentTrader http://www.torrenttrader.com/ is a feature packed and highly customisable open-source BitTorrent tracker." This PoC dumps the username and password's md5 hash of...

GLSA-200405-18 : Buffer Overflow in Firebird

The remote host is affected by the vulnerability described in GLSA-200405-18 Buffer Overflow in Firebird A buffer overflow exists in three Firebird binaries gdsinetserver, gdslockmgr, and gdsdrop that is exploitable by setting a large value to the INTERBASE environment variable. Impact : An...

Nucleus CMS action.php itemid Parameter SQL Injection

The remote host is running Nucleus CMS, an open source content management system. There is a SQL injection condition in the remote version of this software that could allow an attacker to execute arbitrary SQL commands against the remote database. An attacker could exploit this flaw to gain...

SUSE-SA:2003:0008: imp

The remote host is missing the patch for the advisory SUSE-SA:2003:0008 imp. IMP is a well known PHP-based web-mail system. Some SQL-injection vulnerabilities were found in IMP 2.x that allow an attacker to access the underlying database. No authentication is needed to exploit this bug. An attack...

MySQL 4.15.0 - Authentication Bypass

MySQL 4.15.0 - Authentication Bypass source: https://www.securityfocus.com/bid/10654/info MySQL is prone to a vulnerability that may permit remote clients to bypass authentication. This is due to a logic error in the server when handling client-supplied length values for password strings...

Citadel/UX 6.20 fixes local permissions vulnerability

Citadel/UX Security Advisory 2004-01 1. Topic: Updated Citadel/UX package fixes permissions problem which could allow local users direct access to the Citadel/UX database. 2. Relevant releases/architectures: Citadel/UX 5.00 - 6.14, all architectures 3. Problem description: Citadel/UX is a high...

New Macromedia Security Zone Bulletin Posted

Security Bulletin MPSB 04-05 Potential Risk in Dreamweaver Remote Database Connectivity Originally posted: April 1, 2004 Last updated: April 1, 2004 Summary: Dreamweaver's remote database connectivity for testing dynamic database-driven websites installs scripts that may reveal DSNs to outside...