wp-02-0007: Microsoft SQLXML ISAPI Overflow and Cross Site Scripting

Westpoint Security Advisory Title: Microsoft SQLXML ISAPI Overflow and Cross Site Scripting Risk Rating: Medium Software: Microsoft SQLXML 3.0 / IIS 5.0 / SQLServer 2000 Platforms: Win2K Vendor URL: www.microsoft.com Author: Matt Moore [email protected] Date: 12 June 2002 Advisory ID:...

Microsoft SQL Server 2000 - SQLXML Script Injection

Microsoft SQL Server 2000 - SQLXML Script Injection source: https://www.securityfocus.com/bid/5005/info SQLXML is a component of SQL Server 2000, which enables SQL servers to receive and send database queries via XML Extensible Markup Language format. Such queries can be sent using various method...

Microsoft SQL Server 2000 - SQLXML Buffer Overflow (PoC)

Microsoft SQL Server 2000 - SQLXML Buffer Overflow PoC source: https://www.securityfocus.com/bid/5004/info SQLXML is a component of SQL Server 2000, which enables SQL servers to receive and send database queries via XML Extensible Markup Language format. Such queries can be sent using various...

Keyservers Cross Site Scripting (When CSS Gets Dangerous)

Hi, a while ago we discovered this, we have tried to solve this issue with OKS's developer but with no success, maybe further posting of the issue will help. -------------------------------------------------------------------------------- - SUMMARY http://www.openkeyserver.org/ OKS OpenKeyServer...

SMB Scope

This plugin configures Nessus so that it knows if it should query local information on each host or information pertaining to the domain ie: requests will be forwarded to the PDC. If you test a single workstation, you want information about the domain. If you test the whole network, including the...

CVE-1999-1379

CVE-1999-1379 concerns DNS reflection via UDP queries where an attacker spoofs the source address to use DNS name servers as traffic amplifiers, causing amplified traffic toward the victim. The description in the connected records confirms that open resolvers can be abused to generate more traffi...

SNMP Query System Information Disclosure

It is possible to obtain the system information about the remote host by sending SNMP requests with the OID 1.3.6.1.2.1.1.1. An attacker may use this information to gain more knowledge about the target host. TRUSTED...

CVE-2001-0636

Buffer overflows in Raytheon SilentRunner allow remote attackers to 1 cause a denial of service in the collector cle.exe component of SilentRunner 2.0 via traffic containing long passwords, or 2 execute arbitrary commands via long HTTP queries in the Knowledge Browser component in SilentRunner 2....

Microsoft Index Server 2.0 - File Information Full Path Disclosure

Microsoft Index Server 2.0 - File Information Full Path Disclosure source: https://www.securityfocus.com/bid/3339/info The sqlqhit.asp sample file is used for performing web-based SQL queries. Malicious users could send specifically crafted HTTP request to an Internet Information Services server...

CVE-2001-1090

nsspostgresql 0.6.1 and before allows a remote attacker to execute arbitrary SQL queries by inserting SQL code into an HTTP request...

LDAP NULL BASE Search Access

The remote LDAP server supports search requests with a NULL, or empty, base object. This allows information to be retrieved without any prior knowledge of the directory structure. Coupled with a NULL BIND, an anonymous user may be able to query your LDAP server using a tool such as 'LdapMiner'...

phpBB 1.4.0 bug leads to easy admin privileges

-New phpBB 1.4.x exploit phpBB, is an open source bulletin board created by the phpBB group. Version 1.4.x of phpBB has a variable input validation problem that can lead to limited arbitrary sql querys including gaining administrative access to the board. The problem lies in the fact that phpBB...

ID Software Quake 3 - 'SMURF' Denial of Service

// source: https://www.securityfocus.com/bid/3060/info Quake 3 network play features contain a remotely exploitable denial of service vulnerability. A hostile client program can be used by to generate a large number of forged client queries on behalf of a target user. The server's responses flood...

Microsoft SQL Server Administrator Cached Connection Vulnerability

Description Due to a flaw in the handling of specially crafted ad hoc queries, it is possible for a logged in user to utilize the ad hoc query in such a way that the use of the system administrator's cached connection would be invoked rather than that of the user. This would enable the user to...

Trend Micro Interscan VirusWall for Windows NT 3.4/3.5/3.51 - Remote Reconfiguration

source: https://www.securityfocus.com/bid/2808/info Interscan Viruswall is a Virus scanning software package distributed and maintained by Trend Micro. It is designed to scan for virus occurances in both incoming and outgoing traffic via SMTP, FTP, and HTTP at the gateway of the network. The...

CVE-2001-0319

orderdspc.d2w macro in IBM Net.Commerce 3.x allows remote attackers to execute arbitrary SQL queries by inserting them into the orderrn option of the report capability...

CVE-2001-0234

NewsDaemon before 0.21b allows remote attackers to execute arbitrary SQL queries and gain privileges via a malformed userusername parameter...

NCM Content Management System - content.pl Input Validation

NCM Content Management System - content.pl Input Validation source: https://www.securityfocus.com/bid/2584/info The NCM Content Management System is a product distributed by NCM. The NCM Content Management System is designed to manage web material and other data, and provide an interface to...

NCM Content Management System - content.pl Input Validation

source: https://www.securityfocus.com/bid/2584/info The NCM Content Management System is a product distributed by NCM. The NCM Content Management System is designed to manage web material and other data, and provide an interface to databases from web resources. A problem with the Content Manageme...

CVE-2001-0201

The Postaci frontend for PostgreSQL does not properly filter characters such as semicolons, which could allow remote attackers to execute arbitrary SQL queries via the deletecontact.php program...