CVE-2013-0676: Undefined Security Weakness

Siemens WinCC before 7.2, as used in SIMATIC PCS7 before 8.0 SP1 and other products, does not properly assign privileges for the database containing WebNavigator credentials, which allows remote authenticated users to obtain sensitive information via a SQL query...

CVE-2013-0678: Undefined Security Weakness

Siemens WinCC before 7.2, as used in SIMATIC PCS7 before 8.0 SP1 and other products, does not properly represent WebNavigator credentials in a database, which makes it easier for remote authenticated users to obtain sensitive information via a SQL query...

PT-2013-2521

Name of the Vulnerable Software and Affected Versions Siemens WinCC versions prior to 7.2 SIMATIC PCS7 versions prior to 8.0 SP1 Description The issue allows remote authenticated users to obtain sensitive information via a SQL query due to improper assignment of privileges for the database...

PT-2013-2523

Name of the Vulnerable Software and Affected Versions Siemens WinCC versions prior to 7.2 SIMATIC PCS7 versions prior to 8.0 SP1 Description The issue is related to the improper representation of WebNavigator credentials in a database. This makes it easier for remote authenticated users to obtain...

PostgreSQL Denial of Service Vulnerability - Windows

PostgreSQL is prone to a denial of service vulnerability. SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:postgresql:postgresql";...

Joomla RSfiles SQLi Vulnerabilities

Joomla RSfiles is prone to SQL injection SQLi vulnerabilities. SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:joomla:joomla";...

Blog System 2.0 XSS/SQL Injection Vulnerability

Exploit for php platform in category web applications 1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0 0 1 1 /' \ /'\ /\ \ /'\ 0 0 /, \ /\/\ \ \ \ \ ,/\ /\ \ 1 1 //\ \ /' \ /\ //\ Exploit database separated by exploit 0 0 // type local, remote, DoS, etc. 1 1 1 0 +...

Bugzilla < 3.6.13 / 4.0.10 / 4.2.5 / 4.4rc2 Multiple Vulnerabilities

According to its banner, the version of Bugzilla installed on the remote host is affected by multiple vulnerabilities : - A cross-site scripting vulnerability exists due to a flaw in the validation of the 'id' parameter upon submission of the 'showbug.cgi' script. An attacker can leverage this to...

FreeBSD : bugzilla -- multiple vulnerabilities (1c8a039b-7b23-11e2-b17b-20cf30e32f6d)

A Bugzilla Security Advisory reports:Cross-Site Scripting When viewing a single bug report, which is the default, the bug ID is validated and rejected if it is invalid. But when viewing several bug reports at once, which is specified by the format=multiple parameter, invalid bug IDs can go throug...

bugzilla -- multiple vulnerabilities

A Bugzilla Security Advisory reports: Cross-Site Scripting When viewing a single bug report, which is the default, the bug ID is validated and rejected if it is invalid. But when viewing several bug reports at once, which is specified by the format=multiple parameter, invalid bug IDs can go throu...

BlackNova Traders - news.php SQL Injection

BlackNova Traders - news.php SQL Injection source: https://www.securityfocus.com/bid/57910/info BlackNova Traders is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue could allow an attacker ...

Debian DSA-2609-1 : rails - SQL query manipulation

An interpretation conflict can cause the Active Record component of Rails, a web framework for the Ruby programming language, to truncate queries in unexpected ways. This may allow attackers to elevate their privileges. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and...

[SECURITY] [DSA 2609-1] rails security update

------------------------------------------------------------------------- Debian Security Advisory DSA-2609-1 [email protected] http://www.debian.org/security/ Florian Weimer January 16, 2013 http://www.debian.org/security/faq -...

Debian Security Advisory DSA 2609-1 (rails - SQL query manipulation)

An interpretation conflict can cause the Active Record component of Rails, a web framework for the Ruby programming language, to truncate queries in unexpected ways. This may allow attackers to elevate their privileges. OpenVAS Vulnerability Test $Id: deb2609.nasl 6611 2017-07-07 12:07:20Z cfisch...

DSA-2609-1 rails - SQL query manipulation

Bulletin has no description...

Unsafe Query Generation Risk in Ruby on Rails

Due to the way Active Record interprets parameters in combination with the way that JSON parameters are parsed, it is possible for an attacker to issue unexpected database queries with "IS NULL" or empty where clauses. This issue does not let an attacker insert arbitrary values into an SQL query,...

WordPress Theme Nest - codigo SQL Injection

WordPress Theme Nest - codigo SQL Injection source: https://www.securityfocus.com/bid/56792/info The Nest theme for WordPress is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. An attacker can exploit this issue...

Sourcefabric Newscoop - 'f_email' SQL Injection

source: https://www.securityfocus.com/bid/56800/info Newscoop is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue could allow an attacker to compromise the application, access or modify data...

WordPress Theme Toolbox - 'mls' SQL Injection

source: https://www.securityfocus.com/bid/56745/info The Toolbox theme for WordPress is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied input before using it in an SQL query. An attacker can exploit this issue to compromise the application, access o...

WordPress Theme CStar Design - id SQL Injection

WordPress Theme CStar Design - id SQL Injection source: https://www.securityfocus.com/bid/56694/info The CStar Design theme for WordPress is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. An attacker can exploi...