Hycus CMS - Multiple Vulnerabilities

Hycus CMS - Multiple Vulnerabilities Vulnerability ID: HTB22737 Reference: http://www.htbridge.ch/advisory/lfiinhycuscms.html Product: Hycus CMS Vendor: Hycus Web Development Team http://www.hycus.com/ Vulnerable Version: 1.0.3 Vendor Notification: 07 December 2010 Vulnerability Type: LFI Status:...

ISC BIND named allow-query vulnerability

Overview ISC BIND contains a vulnerability in the processing of the allow-query access control specifier. Description According to ISC:When named is running as an authoritative server for a zone and receives a query for that zone data, it first checks for allow-query acls in the zone statement,...

CompactCMS 1.4.1 SQL Injection Vulnerability

Exploit for php platform in category web applications ============================================ CompactCMS 1.4.1 SQL Injection Vulnerability ============================================ Product: CompactCMS Vendor: compactcms.nl http://www.compactcms.nl/ Vulnerable Version: 1.4.1 Vendor...

Mandriva Linux Security Advisory : mysql (MDVSA-2010:222)

Multiple vulnerabilities were discovered and corrected in mysql : - Joins involving a table with with a unique SET column could cause a server crash CVE-2010-3677. - Use of TEMPORARY InnoDB tables with nullable columns could cause a server crash CVE-2010-3680. - The server could crash if there we...

MySQL: mysqld DoS (crash) by processing EXPLAIN statements for complex SQL queries (MySQL bug #52711)

Oracle MySQL 5.1 before 5.1.49 and 5.0 before 5.0.92 allows remote authenticated users to cause a denial of service mysqld daemon crash by using EXPLAIN with crafted "SELECT ... UNION ... ORDER BY SELECT ... WHERE ..." statements, which triggers a NULL pointer dereference in the...

Symantec IM Manager whereClause Parameter SQL Injection (SYM10-010)

The version of Symantec IM Manager installed on the remote Windows host fails to sanitize input to the 'whereClause' parameter of the 'rdpageimlogic.aspx' script before using it in the 'LoggedInUsers.lgx' definition file to construct database queries. An unauthenticated attacker may be able to...

Energine CMS SQL Injection

Vulnerability ID: HTB22655 Reference: http://www.htbridge.ch/advisory/sqlinjectioninenergine.html Product: Energine Vendor: Energine http://energine.org/ Vulnerable Version: Vendor Notification: 13 October 2010 Vulnerability Type: SQL Injection Status: Not Fixed, Vendor Alerted, Awaiting Vendor...

AlstraSoft E-Friends 4.96 Multiple Remote Vulnerabilities

Exploit for php platform in category web applications ========================================================= AlstraSoft E-Friends 4.96 Multiple Remote Vulnerabilities ========================================================= Name AlstraSoft E-Friends Vendor http://www.alstrasoft.com Versions...

AlstraSoft E-Friends 4.96 Multiple Remote Vulnerabilities

AlstraSoft E-Friends 4.96 Multiple Remote Vulnerabilities Name AlstraSoft E-Friends Vendor http://www.alstrasoft.com Versions Affected 4.96 Author Salvatore Fresta aka Drosophila Website http://www.salvatorefresta.net Contact salvatorefresta at gmail dot com Date 2010-10-27 X. INDEX I. ABOUT THE...

Alstrasoft e-Friends 4.96 - Multiple Vulnerabilities

AlstraSoft E-Friends 4.96 Multiple Remote Vulnerabilities Name AlstraSoft E-Friends Vendor http://www.alstrasoft.com Versions Affected 4.96 Author Salvatore Fresta aka Drosophila Website http://www.salvatorefresta.net Contact salvatorefresta at gmail dot com Date 2010-10-27 X. INDEX I. ABOUT THE...

Aardvark Topsite XSS vulnerability

Hi, I found XSS on Aardvark Topsites PHP system. Dork: "Powered by Aardvark Topsites" "SQL Queries" XSS: sitepath/index.php?a=search&q=2220onmouseover3dalertString.fromCharCode88,83,8320par3d22 Can use POST to effect the "email", "title", "u" and "url" parameters either on the same way. Tested...

SQL Injection in 4site CMS

Vulnerability ID: HTB22639 Reference: http://www.htbridge.ch/advisory/sqlinjectionin4sitecms.html Product: 4site CMS Vendor: Method Lab http://www.4site.ru/ Vulnerable Version: 2.6 and probably prior versions Vendor Notification: 05 October 2010 Vulnerability Type: XSS Cross Site Scripting Status...

IBM Tivoli Provisioning Manager for OS Deployment TCP to ODBC Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary SQL queries on vulnerable installations of Tivoli Provisioning Manager. Authentication is not required to exploit this vulnerability. The specific flaw exists within the TCP to ODBC gateway component which listens by default on TCP...

CVE-2010-0218

ISC BIND 9.7.2 through 9.7.2-P1 uses an incorrect ACL to restrict the ability of Recursion Desired RD queries to access the cache, which allows remote attackers to obtain potentially sensitive information via a DNS query...

Joomla! Component JE Guestbook 1.0 - Multiple Vulnerabilities

JE Guestbook 1.0 Joomla Component Multiple Remote Vulnerabilities Name JE Guestbook Vendor http://www.joomlaextensions.co.in Versions Affected 1.0 Author Salvatore Fresta aka Drosophila Website http://www.salvatorefresta.net Contact salvatorefresta at gmail dot com Date 2010-09-30 X. INDEX I. ABO...

E-Xoopport - Samsara SQL Injection Vulnerability

E-Xoopport - Samsara is prone to an SQL injection SQLi vulnerability. SPDX-FileCopyrightText: 2010 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SQL injection vulnerability in Entrans

Vulnerability ID: HTB22608 Reference: http://www.htbridge.ch/advisory/sqlinjectionvulnerabilityinentrans1.html Product: Entrans Vendor: Khader Abbeb N http://sourceforge.net/projects/entrans/ Vulnerable Version: 0.3.2 and Probably Prior Versions Vendor Notification: 13 September 2010 Vulnerabilit...

SQL injection vulnerability in e107

Vulnerability ID: HTB22603 Reference: http://www.htbridge.ch/advisory/sqlinjectionvulnerabilityine1071.html Product: e107 Website System Vendor: e107 http://www.e107.org/ Vulnerable Version: 0.7.23 and Probably Prior Versions Vendor Notification: 03 September 2010 Vulnerability Type: SQL Injectio...

BugTracker.NET 'search.aspx' SQL Injection Vulnerability

The host is running BugTracker.NET and is prone to SQL injection vulnerability. OpenVAS Vulnerability Test $Id: gbbugtrackersqlinjvuln.nasl 5263 2017-02-10 13:45:51Z teissa $ BugTracker.NET 'search.aspx' SQL Injection Vulnerability Authors: Sooraj KS Copyright: Copyright c 2010 Greenbone Networks...

Design/Logic Flaw

The DNS resolution functionality in the CIFS implementation in the Linux kernel before 2.6.35, when CONFIGCIFSDFSUPCALL is enabled, relies on a user's keyring for the dnsresolver upcall in the cifs.upcall userspace helper, which allows local users to spoof the results of DNS queries and perform...