Oracle Financials R12 SQL Injection

Hi all, Yesterday a friend of mine told me that I "forget" to share with the general public one small detail about a presentation 1 I given at the conference RootedCon 2010 2. In the presentation there is a currently working 0day against Oracle Financials R12. The 0day is too obvious and pretty...

Oracle Financials R12 SQL injection vulnerability

Exploit for jsp platform in category web applications ================================================= Oracle Financials R12 SQL injection vulnerability ================================================= Yesterday a friend of mine told me that I "forget" to share with the general public one small...

Oracle E-Business Suite Financials 12 - jtfwcpnt.jsp SQL Injection

Oracle E-Business Suite Financials 12 - jtfwcpnt.jsp SQL Injection source: https://www.securityfocus.com/bid/39510/info Oracle E-Business Suite Financials is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query...

Unfixed XSS vulnerability at www.logicalfinancials.co.uk

Security researcher Azat Harutyunyan, has submitted on 01/06/2008 a cross-site-scripting XSS vulnerability affecting www.logicalfinancials.co.uk, which at the time of submission ranked 0 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 06/06/200...

CVE-2002-2301

CVE-2002-2301 affects Lawson Financials 8.0 when configured to use a third‑party relational database. The underlying issue is that usernames and passwords are stored in a world‑readable file, enabling local users to obtain credentials and log onto the database. The description does not provide ve...

CVE-2002-2301

Lawson Financials 8.0, when configured to use a third party relational database, stores usernames and passwords in a world-readable file, which allows local users to read the passwords and log onto the database...

CVE-2006-2718

JIWA Financials 6.4.14 passes a Microsoft SQL Server account's username and password, and the name of a data source, to a Crystal Reports .rpt file, which allows remote authenticated users to execute certain standard stored procedures by referencing them in a user-written .rpt file, as demonstrat...

CVE-2006-2719

JIWA Financials 6.4.14 stores usernames and passwords for all accounts in cleartext in the HRStaff table in Microsoft SQL Server, and sends the usernames and passwords in cleartext to the application's SQL Server ODBC driver, which might allow context-dependent attackers to obtain the passwords...

Default credentials

JIWA Financials 6.4.14 passes a Microsoft SQL Server account's username and password, and the name of a data source, to a Crystal Reports .rpt file, which allows remote authenticated users to execute certain standard stored procedures by referencing them in a user-written .rpt file, as demonstrat...

CVE-2006-2719

JIWA Financials 6.4.14 stores usernames and passwords for all accounts in cleartext in the HRStaff table in Microsoft SQL Server, and sends the usernames and passwords in cleartext to the application's SQL Server ODBC driver, which might allow context-dependent attackers to obtain the passwords...

CVE-2006-2718

CVE-2006-2718 describes a vulnerability in JIWA Financials 6.4.14 where a Microsoft SQL Server account username, password, and the data source name are passed to a Crystal Reports .rpt file. This enables remote authenticated users to invoke certain stored procedures by referencing them in a user-...

CVE-2006-2719

JIWA Financials 6.4.14 stores usernames and passwords for all accounts in cleartext in the HR_Staff table of Microsoft SQL Server and transmits them in cleartext to the application's SQL Server ODBC driver, enabling potential credential exposure to context-dependent attackers. The available docum...

Design/Logic Flaw

Unspecified vulnerability in the Financials for Asia/Pacific component in Oracle E-Business Suite and Applications 11.5.9 has unknown impact and attack vectors. component, aka Vuln APPS02...

CVE-2006-1881

Unspecified vulnerability in the Financials for Asia/Pacific component in Oracle E-Business Suite and Applications 11.5.9 has unknown impact and attack vectors. component, aka Vuln APPS02...

CVE-2006-1881

Unspecified vulnerability in the Financials for Asia/Pacific component in Oracle E-Business Suite and Applications 11.5.9 has unknown impact and attack vectors. component, aka Vuln APPS02...

CVE-2006-1881

CVE-2006-1881 affects Oracle E-Business Suite and Applications 11.5.9 — Financials for Asia/Pacific component. The vulnerability is described as unspecified with unknown impact and attack vectors (APPS02). The NVD entry lists a high base score (CVSSv2 10.0) but provides no concrete exploitation d...

CVE-2002-2301

Lawson Financials 8.0, when configured to use a third party relational database, stores usernames and passwords in a world-readable file, which allows local users to read the passwords and log onto the database...

Advisory: Lawson Financials RDBMS Insecurity

+-----------------------------------------------------------------------+ | Advisory: lawson001 | | Authors: John Eisenschmidt [email protected] | | George Lewis [email protected] | | Release Date: December 02, 2002 | | Vendor: Lawson | | Application: Financials possibly others | | Affected...

CVE-2001-0392

Navision Financials Server 2.60 and earlier allows remote attackers to cause a denial of service by sending a null character and a long string to the server port 2407, which causes the server to crash...

CVE-2001-0393

Navision Financials Server 2.0 allows remote attackers to cause a denial of service via a series of connections to the server without providing a username/password combination, which consumes the license limits...