[Full-disclosure] Cross-Site-Scripting Vulnerability in Oracle iSQL*Plus

Cross-Site-Scripting Vulnerability in Oracle iSQLPlus Name Cross-Site-Scripting Vulnerability in Oracle iSQLPlus Systems Affected Oracle Database 9i Rel. 2 Severity Low Risk Category Cross Site Scripting CSS/XSS Vendor URL http://www.oracle.com This advisory...

[Full-disclosure] Shutdown TNS Listener via Oracle iSQL*Plus

Shutdown TNS Listener via Oracle iSQLPlus Name Shutdown TNS Listener via Oracle iSQLPlus Systems Affected Oracle Database 9i Rel. 2 Severity Medium Risk Category Denial of Service Vendor URL http://www.oracle.com This advisory http://www.red-database-security.com/advisory/oracleisqlplusshutdown.h...

[Full-disclosure] Cross-Site-Scripting Vulnerabilities in Oracle HTMLDB

Cross-Site-Scripting Vulnerabilities in Oracle HTMLDB Name Cross-Site-Scripting Vulnerabilities in Oracle HTMLDB Systems Affected Oracle HTMLDB Severity Medium Risk Category Cross Site Scripting CSS/XSS Vendor URL http://www.oracle.com This advisory...

[Full-disclosure] Shutdown TNS Listener via Oracle Forms Servlet

Shutdown TNS Listener via Oracle Forms Servlet Name Shutdown TNS Listener via Oracle Forms Servlet Systems Affected Oracle Forms Severity Medium Risk Category Denial of Service Vendor URL http://www.oracle.com This advisory http://www.red-database-security.com/advisory/oracleformsshutdown.html...

[Full-disclosure] Cross-Site-Scripting Vulnerability in Oracle XMLDB

Cross-Site-Scripting Vulnerability in Oracle XMLDB Name Cross-Site-Scripting Vulnerability in Oracle XMLDB Systems Affected Oracle Database 9i Rel. 2 Severity Low Risk Category Cross Site Scripting CSS/XSS Vendor URL http://www.oracle.com This advisory...

Lotus Domino weak files permissions

Database names.nsf with password hashes is world readable...

CVE-2004-2398

Vulnerability summary (CVE-2004-2398): Netenberg Fantastico De Luxe 2.8 stores database file names that reveal usernames because file names in the database directory are readable. This enables local attackers to enumerate valid usernames by listing files under /var/lib/mysql, where permissions we...

CVE-2005-2571

FunkBoard 0.66CF (and possibly earlier) has an access-control flaw: the admin/mysql_install.php and admin/pg_install.php scripts are not properly restricted, allowing an attacker to obtain the database username and password or inject arbitrary PHP code into info.php. The issue is described as a l...

Various Cross-Site-Scripting Vulnerabilities in Oracle Reports

Name Various Cross-Site-Scripting Vulnerabilities in Oracle Reports Systems Affected Oracle Reports 9.0.2 Severity Low Risk Category Cross Site Scripting CSS/XSS Vendor URL http://www.oracle.com Author Alexander Kornbrust ak at red-database-security.com Date 19 July 2005 V 1.00 Inital bug report...

Run any OS Command via unauthorized Oracle Reports

Name Run any OS Command via unauthorized Oracle Reports Systems Affected Oracle Reports 6.0, 6i, 9i, 10g Severity High Risk Category OS command execution Vendor URL http://www.oracle.com Author Alexander Kornbrust ak at red-database-security.com Date 19 July 2005 V 1.00 Advisory AKSEC2003-014...

Read parts of any file via desformat in Oracle Reports

Name Read parts of any file via desformat in Oracle Reports Systems Affected All version of Oracle Reports Severity Medium Risk Category Information disclosure Vendor URL http://www.oracle.com Author Alexander Kornbrust ak at red-database-security.com Date 19 July 2005 V 1.00 Advisory AKSEC2003-0...

CVE-2005-2293

CVE-2005-2293 affects Oracle Forms/FormsBuilder 9.0.4, where credentials (database usernames and passwords) are written to a temporary file that is not deleted after use. This enables local users to access sensitive information. The NVD entry documents a local-authentication impact with a MEDIUM ...

[Full-disclosure] Silently fixed security bugs in Oracle Critical Patch Update July 2005

Hello BugTraq-Reader After reading the patch documentation and some tests with the CPU July 2005 I found out that Oracle fixed some security bugs silently without mention these bugs in their current risk matrix. Detailed information about most of these bugs are not available via Metalink but in...

CVE-2002-2027

The CVE-2002-2027 entry concerns DOOW (Database of Our Owlish Wisdom) versions 0.1 through 0.2.1, where insufficient verification of user permissions enables remote attackers to perform unauthorized activities. The available documents confirm the affected product and the underlying issue (permiss...

CVE-2000-1235

Oracle IAS 3.0.7 and earlier are affected by CVE-2000-1235 due to default configurations of the port listener and mod_plsql, enabling remote attackers to view privileged database information via HTTP requests for DAD files. Affected component is the mod_plsql DAD handling exposed by default; root...

Symantec Brightmail AntiSpam database unauthorized access

Static built-in password is used to access database...

CVE-2005-1645

The CVE describes a vulnerability in Keyvan1 ImageGallery where the image.mdb database is stored under the web document root with insufficient access control, allowing remote attackers to read sensitive information. Impact: partial confidentiality loss. The connected documents do not provide expl...

JGS-Portal 3.0.1/3.0.2 - 'jgs_portal_sponsor.php?id' SQL Injection

source: https://www.securityfocus.com/bid/13650/info JGS-Portal is prone to multiple cross-site scripting and SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. Successful exploitation of the SQL injection issues could...

MaxWebPortal < 1.360 Multiple Vulnerabilities

Binary data 2898.prm...

CVE-2004-1833

CVE-2004-1833 affects Borland Interbase 7.1 on Linux. The admin.ib file has default world-writable permissions, enabling local users to gain database administrative privileges (privilege escalation). No remediation details are provided in the supplied documents; mode is based on the concrete desc...