FreeBSD : wordpress -- XMLRPC SQL Injection (0838733d-1698-11dc-a197-0011098b2f36)

Secunia reports : Slappter has discovered a vulnerability in WordPress, which can be exploited by malicious users to conduct SQL injection attacks. Input passed to the 'wp.suggestCategories' method in xmlrpc.php is not properly sanitised before being used in SQL queries. This can be exploited to...

p5-Net-DNS -- multiple Vulnerabilities

A Secunia Advisory reports: An error exists in the handling of DNS queries where IDs are incremented with a fixed value and are additionally used for child processes in a forking server. This can be exploited to poison the DNS cache of an application using the module if a valid ID is guessed. An...

Calendarix calendar.php Multiple Parameter SQL Injection

The remote host is running Calendarix, a free web-based calendar application written in PHP. The version of Calendarix installed on the remote host fails to sanitize input to the 'month' and 'year' parameters of the 'calendar.php' script before using it in database queries. Provided PHP's...

Calendarix <= 0.7.20070307 calendar.php month and year parameter SQL Injection

Binary data 4113.prm...

CVE-2007-3278

PostgreSQL 8.1 and probably later versions, when local trust authentication is enabled and the Database Link library dblink is installed, allows remote attackers to access arbitrary accounts and execute arbitrary SQL queries via a dblink host parameter that proxies the connection from 127.0.0.1...

Sql injection

PostgreSQL 8.1 and probably later versions, when local trust authentication is enabled and the Database Link library dblink is installed, allows remote attackers to access arbitrary accounts and execute arbitrary SQL queries via a dblink host parameter that proxies the connection from 127.0.0.1...

CVE-2007-3278

PostgreSQL 8.1 and probably later versions, when local trust authentication is enabled and the Database Link library dblink is installed, allows remote attackers to access arbitrary accounts and execute arbitrary SQL queries via a dblink host parameter that proxies the connection from 127.0.0.1...

MaraDNS denial of service vulnerabilities

--------------------------------------- Synopsis ---------------------------------------- Product: MaraDNS http://www.maradns.org Affected versions: 1.2.12.05 stable and 1.3.04 testing and prior versions Type: Local resource exhaustion / denial of service Risk: Remote denial of service Remote: Ye...

Fusetalk SQL injection submission.

Greetings, I have found sql injection in FuseTalk 2.0 during a legitmate audit. Resending because I got MIME errors to [email protected]. I have exchanged emails with [email protected] who needed more information when I originally sent an email to [email protected] Operating...

c-ares -- DNS Cache Poisoning Vulnerability

Secunia reports: The vulnerability is caused due to predictable DNS "Transaction ID" field in DNS queries and can be exploited to poison the DNS cache of an application using the library if a valid ID is guessed...

wordpress -- XMLRPC SQL Injection

Secunia reports: Slappter has discovered a vulnerability in WordPress, which can be exploited by malicious users to conduct SQL injection attacks. Input passed to the "wp.suggestCategories" method in xmlrpc.php is not properly sanitised before being used in SQL queries. This can be exploited to...

waraxe-2007-SA051.txt

waraxe-2007-SA051 - Sql Injection in 2z Project 0.9.5 ==================================================================== Author: Janek Vind "waraxe" Date: 23. May 2007 Location: Estonia, Tartu Web: http://www.waraxe.us/advisory-51.html Target software description: Vulnerable: 2z Project 0.9.5...

YaNC Component for Joomla! 'listid' Parameter SQLi

The version of the YaNC component for Joomla! and Mambo running on the remote host is affected by a SQL injection vulnerability in the components/comyanc/yanc.html.php script due to improper sanitization of user-supplied input to the 'listid' parameter before using it to construct database querie...

GLSA-200705-11 : MySQL: Two Denial of Service vulnerabilities

The remote host is affected by the vulnerability described in GLSA-200705-11 MySQL: Two Denial of Service vulnerabilities mu-b discovered a NULL pointer dereference in itemcmpfunc.cc when processing certain types of SQL requests. Sec Consult also discovered another NULL pointer dereference when...

CVE-2007-0939: Undefined Security Weakness

Cross-site scripting XSS vulnerability in Microsoft Content Management Server MCMS 2001 SP1 and 2002 SP2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors involving HTML redirection queries, aka "Cross-site Scripting and Spoofing Vulnerability."...

CVE-2006-4175: Access of Uninitialized Pointer

The LDAP server ns-slapd in Sun Java System Directory Server 5.2 Patch4 and earlier and ONE Directory Server 5.1 and 5.2 allows remote attackers to cause a denial of service crash via malformed queries, probably malformed BER queries, which trigger a free of uninitialized memory locations...

PT-2007-1167 · Sun · Sun One Directory Server +1

Name of the Vulnerable Software and Affected Versions: Sun Java System Directory Server versions 5.2 Patch4 and earlier ONE Directory Server versions 5.1 and 5.2 Description: The issue allows remote attackers to cause a denial of service, resulting in a crash, by sending malformed queries to the...

USN-440-1: MySQL vulnerability

Stefan Streichbier and B. Mueller of SEC Consult discovered that MySQL subselect queries using "ORDER BY" could be made to crash the MySQL server. An attacker with access to a MySQL instance could cause an intermitant denial of service...

GLSA-200703-15 : PostgreSQL: Multiple vulnerabilities

The remote host is affected by the vulnerability described in GLSA-200703-15 PostgreSQL: Multiple vulnerabilities PostgreSQL does not correctly check the data types of the SQL function arguments under unspecified circumstances nor the format of the provided tables in the query planner. Impact : A...

Duyuru Scripti - Goster.asp SQL Injection

Duyuru Scripti - Goster.asp SQL Injection source: https://www.securityfocus.com/bid/22910/info Duyuru Scripti is prone to an SQL-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in an SQL query. Exploiting this vulnerability could perm...