oracleXSS.txt

Software: Oracle HTTP Server Powered by Apache Vendor: http://www.apache.com http://www.oracle.com Versions: Oracle HTTP Server Powered by Apache/1.3.22 Win32 modplsql/3.0.9.8.3b modssl/2.8.5 OpenSSL/0.9.6b modfastcgi/2.2.12 modoprocmgr/1.0 modperl/1.25 Platforms: Windows Bug: Cross Site Scriptin...

MetaDot < 5.6.5.4b5 - Multiple Vulnerabilities

MetaDot Multiple Vulnerabilities Vendor: Metadot Corporation Product: MetaDot Version: = 5.6.5.4b5 Website: http://www.metadot.com/ BID: 9439 Description: Metadot is a popular open source portal software GPL recognized for its revolutionary ease-of-use. It provides content management like file,...

Mambo Open Source 4.0.14 Server - SQL Injection

Mambo Open Source 4.0.14 Server - SQL Injection source: https://www.securityfocus.com/bid/9196/info It has bee reported that Mambo Open Source 4.0.14 Server is prone to SQL injection attacks. The problem is said to occur due to insufficient sanitization of data passed to specific index.php...

CVE-2003-0641

WatchGuard ServerLock for Windows 2000 before SL 2.0.3 allows local users to load arbitrary modules via the OpenProcess function, as demonstrated using 1 a DLL injection attack, 2 ZwSetSystemInformation, and 3 API hooking in OpenProcess...

CVE-2003-0641

WatchGuard ServerLock for Windows 2000 before SL 2.0.3 allows local users to load arbitrary modules via the OpenProcess function, as demonstrated using 1 a DLL injection attack, 2 ZwSetSystemInformation, and 3 API hooking in OpenProcess...

Synkron.Web 3.0 - HTML Injection

Synkron.Web 3.0 - HTML Injection source: https://www.securityfocus.com/bid/7833/info Synkron.web is prone to HTML injection attacks. The vulnerability exists in the search script and is a result of insufficient sanitization of malicious HTML code from user-supplied input. HTML and script code may...

Microsoft BizTalk Server Multiple Remote Vulnerabilities

The remote host seems to be running Microsoft BizTalk server. There are two flaws in this software that could allow an attacker to issue a SQL insertion attack or to execute arbitrary code on the remote host. Note that Nessus solely relied on the presence of a Biztalk DLL to issue this alert so i...

PHP-Nuke 6.5 (Multiple Downloads Module) - SQL Injection

source: https://www.securityfocus.com/bid/7588/info PHP-Nuke is reportedly prone to multiple SQL injection vulnerabilities in the Downloads module. Exploitation could allow for injection of malicious SQL syntax, resulting in modification of SQL query logic or other attacks...

vSignup 2.1 - SQL Injection

vSignup 2.1 - SQL Injection source: https://www.securityfocus.com/bid/6606/info A vulnerability has been discovered in vSignup. It has been reported that various PHP scripts used by vAuthenticate are prone to SQL injection attacks. This issue may be exploited by an unauthorized attacker to view...

PHPPass 2 - 'AccessControl.php' SQL Injection

source: https://www.securityfocus.com/bid/6594/info A problem with phpPass may allow an attacker to launch a SQL injection attack. The vulnerability exists in the accesscontrol.php script included with phpPass. Due to insufficient sanitization of user-supplied input, it is possible for a remote...

CVE-2002-1256

The SMB signing capability in the Server Message Block SMB protocol in Microsoft Windows 2000 and Windows XP allows attackers to disable the digital signing settings in an SMB session to force the data to be sent unsigned, then inject data into the session without detection, e.g. by modifying gro...

CVE-2002-0961

Vulnerabilities in Voxel Dot Net CBMS 0.7 and earlier allow remote attackers to conduct unauthorized operations as other users, e.g. by deleting clients via dltclnt.php, possibly in a SQL injection attack...

PHP source injection in phpWebSite

-------------------------------------- | PHP source injection in phpWebSite | -------------------------------------- Product Description =================== phpWebSite is written in the PHP Programming Language, making it ideal for developers to write customized plug-ins. PHP is a server side...

CVE-2002-0554

webdriver in IBM Informix Web DataBlade 4.12 allows remote attackers to bypass user access levels or read arbitrary files via a SQL injection attack in an HTTP request...

CVE-2002-0539

Demarc PureSecure 1.05 allows remote attackers to gain administrative privileges via a SQL injection attack in a session ID that is stored in the skey cookie...

Summit Computer Networks Lil' HTTP Server 2 - 'URLCount.cgi' HTML Injection

source: https://www.securityfocus.com/bid/5115/info Lil' HTTP server is a web server application for Windows environments and is maintained by Summit Computer Networks. Reportedly, Lil' HTTP Server is vulnerable to HTML injection attacks. The vulnerability is present in the 'REPORT' function foun...

MyHelpDesk 20020509 - HTML Injection

MyHelpDesk 20020509 - HTML Injection source: https://www.securityfocus.com/bid/4967/info It has been reported that MyHelpDesk is vulnerable to HTML injection attacks. MyHelpDesk does not properly sanitize HTML tags from form fields. Attackers may pass arbitrary HTML and script code through the...

MyHelpDesk 20020509 - SQL Injection

source: https://www.securityfocus.com/bid/4971/info It is reported that MyHelpDesk version 20020509 and earlier are vulnerable to SQL injection attacks. Data supplied by the remote user, via CGI parameters, is used directly as part of SQL statements. As input sanitization is not properly performe...

AOL Instant Messenger 4.x - Arbitrary File Creation

source: https://www.securityfocus.com/bid/4526/info An issue has been reported, which could allow an AIM user to save files to arbitrary locations. Reportedly, this is achievable when a direct connection is made between two AIM users. Files that are sent to a user include an img tag and a data ta...

[NEWS] Demarc PureSecure Allows Users to Bypass Login Restrictions

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com - - promotion When was the last time you checked your server's security? How about a monthly report? http://www.AutomatedScanning.com - Know that you're...