Symantec Brightmail AntiSpam database unauthorized access

Static built-in password is used to access database...

CVE-2005-1645

The CVE describes a vulnerability in Keyvan1 ImageGallery where the image.mdb database is stored under the web document root with insufficient access control, allowing remote attackers to read sensitive information. Impact: partial confidentiality loss. The connected documents do not provide expl...

JGS-Portal 3.0.1/3.0.2 - 'jgs_portal_sponsor.php?id' SQL Injection

source: https://www.securityfocus.com/bid/13650/info JGS-Portal is prone to multiple cross-site scripting and SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. Successful exploitation of the SQL injection issues could...

MaxWebPortal < 1.360 Multiple Vulnerabilities

Binary data 2898.prm...

CVE-2004-1833

CVE-2004-1833 affects Borland Interbase 7.1 on Linux. The admin.ib file has default world-writable permissions, enabling local users to gain database administrative privileges (privilege escalation). No remediation details are provided in the supplied documents; mode is based on the concrete desc...

CVE-2004-2060

ASPrunner 2.4 stores the database under the web root in the db/ directory, which may allow remote attackers to retrieve the database by directly requesting the database file. The vulnerability is tied to predictable database filenames based on table and field names. Affected product: ASPrunner (2...

Oracle 10g DBMS_SCHEDULER Privilege Escalation

The remote host is running a version of Oracle 10g that, according to its version number, permits a user with CREATE job privileges to switch the sessionuser to SYS, which could allow privilege escalation. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc';...

Oracle 9i10g - Database Fine Grained Audit Logging Failure

Oracle 9i10g - Database Fine Grained Audit Logging Failure source: https://www.securityfocus.com/bid/13510/info Oracle 9i/10g Database is prone to a logging failure vulnerability that exists in Fine Grained Audit FGA functionality. Reports indicate that FGA may be disabled inadvertently, without...

FishCart 3.1 - 'upstnt.php?cartid' SQL Injection

source: https://www.securityfocus.com/bid/13499/info FishCart is prone to multiple cross-site scripting and SQL-injection vulnerabilities because the application fails to properly sanitize user-supplied input. A successful exploit of the SQL-injection issues could allow an attacker to compromise...

CVE-2005-1425

CVE-2005-1425 affects Uguestbook 1.0, where sensitive data is stored under the web root with insufficient access control. Remote attackers can directly request mdb-database/guestbook.mdb to download the database. CVSS v2 base score is 5.0 (Medium) with network attack, low complexity, no authentic...

Cross Site Scripting in Oracle Webcache 9i

Name Cross Site Scripting in Oracle Webcache 9i Systems Affected Oracle Application Server with Webcache 9i Severity Low Risk Category Cross Site Scripting Vendor URL http://www.oracle.com Author Alexander Kornbrust ak at red-database-security.com Date 26 Apr 2005 V 1.00 Advisory AKSEC2003-011 Ti...

[HV-HIGH] Microsoft Jet DB engine vulnerabilities

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Microsoft Jet DB engine vulnerabilities Classification: =============== Level: low-med-HIGH-crit ID: HEXVIEW200503311 URL: http://www.hexview.com/docs/20050331-1.txt Overview: ========= Microsoft Jet database is a lightweight database widely used by M...

ESMI PayPal StoreFront 1.7 - products1.php?id2 SQL Injection

ESMI PayPal StoreFront 1.7 - products1.php?id2 SQL Injection source: https://www.securityfocus.com/bid/12903/info ESMI PayPal Storefront is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in as SQL...

ESMI PayPal StoreFront 1.7 - 'pages.php?idpages' SQL Injection

source: https://www.securityfocus.com/bid/12903/info ESMI PayPal Storefront is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in as SQL query. Successful exploitation could result in a compromise ...

BetaParticle blog 2.03.0 - myFiles.asp File Manipulation

BetaParticle blog 2.03.0 - myFiles.asp File Manipulation source: https://www.securityfocus.com/bid/12861/info betaparticle blog is reported prone to multiple vulnerabilities. The following individual issues are reported: It is reported that betaparticle blog fails to sufficiently secure the...

CVE-2004-1758

BEA WebLogic Server/Express (versions 8.1 up to SP2, 7.0 up to SP4, 6.1 up to SP6) may store the database username and password for an untargeted JDBC connection pool in plaintext in config.xml, enabling local users to gain privileges. Root cause: credentials stored in plaintext within config.xml...

postnuke -- SQL injection vulnerabilities

Two separate SQL injection vulnerabilities have been identified in the PostNuke PHP content management system. An attacker can use this vulnerability to potentially insert executable PHP code into the content management system to view all files within the PHP scope, for instance. Various other SQ...

WebCalendar login.php webcalendar_session Cookie SQL Injection

The remote version of WebCalendar contains a SQL injection vulnerability that may allow an attacker to execute arbitrary SQL statements against the remote database. An attacker may be able to leverage this issue to, for example, delete arbitrary database tables. %NASLMINLEVEL 70300 C Tenable...

CVE-2004-1447

Jetbox One 2.0.8 (and possibly other versions) stores passwords in the database in plaintext, exposing user credentials. Root cause: plaintext credential storage in the data store, enabling potential disclosure if the database is accessed. CVE-2004-1447 is described with a Medium base score (AV:N...

SQL Injection Vulnerability In IBProArcade

A flaw exists in the high scores module of IbProArcade which allows malicious SQL Code to be executed on the database the board & arcade use. Demo: http://www.ibproarcade.com/index.php?act=Arcade&do=stats&gameid=104FOO Fix this vuln by following the following directions... open your...