CVE-2006-6554

CVE-2006-6554 affects Kerio MailServer prior to 6.3.1. The issue is a denial-of-service: remote attackers can trigger a segmentation fault and service stoppage by sending certain long LDAP search queries (as demonstrated by vd_kms6.pm). What is affected: Kerio MailServer’s LDAP handling component...

CVE-2006-6554: Undefined Security Weakness

Unspecified vulnerability in Kerio MailServer before 6.3.1 allows remote attackers to cause a denial of service segmentation fault and service stop via certain long LDAP queries, as demonstrated by vdkms6.pm...

UStore 1.0 (detail.asp) Remote SQL Injection Vulnerability

Exploit for unknown platform in category web applications ========================================================== UStore 1.0 detail.asp Remote SQL Injection Vulnerability ========================================================== Title : UStore 1.0 detail.asp Remote SQL Injection Vulnerability...

[Full-disclosure] Invision Power Board 2.1.7 debug mode vulnerability

Debug mode is a feature in IPB 2.0.0-2.1.7 that shows all database queries for each forum page requested. If Debug mode is turned on, it is possible for anyone to request a forgotten password for an account, and capture the validation key that is sent to the account's email address. This allows a...

PunBB 1.x - SQL Injection

source: https://www.securityfocus.com/bid/20786/info PunBB is prone to multiple input-validation vulnerabilities because it fails to sufficiently sanitize user-supplied data. An attacker may exploit these issues to execute arbitrary script code in the context of the webserver process or to pass...

[KAPDA::#61] - PacPoll <= 4.0 Multiple Vulnerabilities

KAPDA New advisory Vulnerable product : PacPoll = 4.0 Vendor: http://www.pacosdrivers.com/asp/poll/poll.asp Vulnerability: Admin Logon bypass , SQLInjection Date : -------------------- Found : 2006/10/10 Vendor Contacted : N/A Release Date : 2006/10/25 Vulnerabilities: -------------------- Admin...

Oracle MDSYS.SDO_LRS package vulnerable to PL/SQL injection

Overview The Oracle MDSYS.SDOLRS package is vulnerable to PL/SQL injection. This vulnerability may allow a remote, authenticated attacker to execute arbitrary PL/SQL commands on a vulnerable Oracle installation. Description The Oracle MDSYS.SDOLRS package is vulnerable to PL/SQL injection...

Debian DSA-1169-1 : mysql-dfsg-4.1 - several vulnerabilities

Several local vulnerabilities have been discovered in the MySQL database server. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2006-4226 Michal Prokopiuk discovered that remote authenticated users are permitted to create and access a database if the...

PHP Classifieds 7.1 - 'index.php' SQL Injection

---- Credit: Kzar [email protected] kzar.co.uk/exploits/phpclassifiedsexploit ---- App Name: PHP Classifieds = 7.1 App URL: www.deltascripts.com/phpclassifieds Problem: Multiple SQL Injection exploits ---- Exploit: search.php?catidsearch=sql index.php?catid=sql ---- Example: Puts Username and...

BIND: Denial of service

Background ISC BIND is the Internet Systems Consortium implementation of the Domain Name System DNS protocol. Description Queries for SIG records will cause an assertion error if more than one SIG RRset is returned. Additionally, an INSIST failure can be triggered by sending multiple recursive...

CVE-2006-4095

BIND before 9.2.6-P1 and 9.3.x before 9.3.2-P1 allows remote attackers to cause a denial of service crash via certain SIG queries, which cause an assertion failure when multiple RRsets are returned...

CVE-2006-4096

BIND before 9.2.6-P1 and 9.3.x before 9.3.2-P1 allows remote attackers to cause a denial of service crash via a flood of recursive queries, which cause an INSIST failure when the response is received after the recursion queue is empty...

DEBIAN-CVE-2006-4095

BIND before 9.2.6-P1 and 9.3.x before 9.3.2-P1 allows remote attackers to cause a denial of service crash via certain SIG queries, which cause an assertion failure when multiple RRsets are returned...

DEBIAN-CVE-2006-4096

BIND before 9.2.6-P1 and 9.3.x before 9.3.2-P1 allows remote attackers to cause a denial of service crash via a flood of recursive queries, which cause an INSIST failure when the response is received after the recursion queue is empty...

CVE-2006-4095

BIND before 9.2.6-P1 and 9.3.x before 9.3.2-P1 allows remote attackers to cause a denial of service crash via certain SIG queries, which cause an assertion failure when multiple RRsets are returned...

CVE-2006-4562

The proxy DNS service in Symantec Gateway Security SGS allows remote attackers to make arbitrary DNS queries to third-party DNS servers, while hiding the source IP address of the attacker. NOTE: another researcher has stated that the default configuration does not proxy DNS queries received on th...

CVE-2006-4562

CVE-2006-4562 affects Symantec Gateway Security (SGS): the proxy DNS service permits remote attackers to cause arbitrary DNS queries to third‑party DNS servers while concealing the attacker’s source IP. Default configurations may not proxy DNS queries on the external interface. The available docu...

CVE-2006-4095: Reachable Assertion

BIND before 9.2.6-P1 and 9.3.x before 9.3.2-P1 allows remote attackers to cause a denial of service crash via certain SIG queries, which cause an assertion failure when multiple RRsets are returned...

CVE-2006-4096

BIND before 9.2.6-P1 and 9.3.x before 9.3.2-P1 allows remote attackers to cause a denial of service crash via a flood of recursive queries, which cause an INSIST failure when the response is received after the recursion queue is empty...

PT-2006-5355 · Symantec · Symantec Gateway Security

Name of the Vulnerable Software and Affected Versions: Symantec Gateway Security SGS affected versions not specified Description: The issue allows remote attackers to make arbitrary DNS queries to third-party DNS servers while hiding the source IP address of the attacker. It is related to the pro...