CVE-2012-1099

Cross-site scripting XSS vulnerability in actionpack/lib/actionview/helpers/formoptionshelper.rb in the select helper in Ruby on Rails 3.0.x before 3.0.12, 3.1.x before 3.1.4, and 3.2.x before 3.2.2 allows remote attackers to inject arbitrary web script or HTML via vectors involving certain...

CVE-2012-1099

Cross-site scripting XSS vulnerability in actionpack/lib/actionview/helpers/formoptionshelper.rb in the select helper in Ruby on Rails 3.0.x before 3.0.12, 3.1.x before 3.1.4, and 3.2.x before 3.2.2 allows remote attackers to inject arbitrary web script or HTML via vectors involving certain...

CVE-2012-1099

Concretely, CVE-2012-1099 affects Ruby on Rails ActionPack’s select helper in action_view/form_options_helper.rb. The vulnerability allows remote XSS via certain OPTION element generation in , impacting Rails 3.0.x (<3.0.12), 3.1.x (<3.1.4), and 3.2.x (

SQLAlchemy 'limit'和'offset'参数SQL注入漏洞

Bugtraq ID: 52330 CVE ID: CVE-2012-0805 SQLAlchemy是一个Python的SQL工具包以及数据库对象映射框架 通过"limit"和"offset"关键词传递给"select"函数的输入在用于SQL查询之前缺少过滤，攻击者可以利用漏洞进行SQL注入攻击，可获得敏感信息或操作数据库 0 SQLAlchemy 0.7.0 SQLAlchemy 0.6.8 SQLAlchemy 0.6.7 厂商解决方案 SQLAlchemy 0.7.0b已经修复此漏洞，建议用户下载使用： http://www.sqlalchemy.org/...

CVE-2012-1099 rubygem-actionpack: XSS in the "select" helper

Cross-site scripting XSS vulnerability in actionpack/lib/actionview/helpers/formoptionshelper.rb in the select helper in Ruby on Rails 3.0.x before 3.0.12, 3.1.x before 3.1.4, and 3.2.x before 3.2.2 allows remote attackers to inject arbitrary web script or HTML via vectors involving certain...

SA-CONTRIB-2012-028 - Hierarchical Select - Cross Site Scripting (XSS)

CVE: CVE-2012-1652 The Hierarchical Select module provides a "hierarchicalselect" form element, which is a greatly enhanced way for letting the user select items in a taxonomy. The module does not sanitize some of the user-supplied data before displaying it, leading to a Cross Site Scripting XSS...

IBM solidDB 6.5 < 6.5.0.8 Interim Fix 6 Redundant WHERE Clause Select Statement Parsing Remote DoS

According to its version number, the solidDB install on the remote host is affected by a denial of service vulnerability due to a flaw in the way the application handles 'SELECT' statements containing a redundant WHERE condition. %NASLMINLEVEL 70300 C Tenable Network Security, Inc...

CVE-2012-0200

The server in IBM solidDB 6.5 before Interim Fix 6 does not properly initialize data structures, which allows remote authenticated users to cause a denial of service daemon crash via a SELECT statement with a redundant WHERE condition...

CVE-2011-4890

The server in IBM solidDB 6.5 before FP9 and 7.0 before FP1 allows remote authenticated users to cause a denial of service daemon crash via a SELECT statement with a ROWNUM condition involving a subquery...

Design/Logic Flaw

The server in IBM solidDB 6.5 before FP9 and 7.0 before FP1 allows remote authenticated users to cause a denial of service daemon crash via a SELECT statement with a ROWNUM condition involving a subquery...

CVE-2011-4890

The server in IBM solidDB 6.5 before FP9 and 7.0 before FP1 allows remote authenticated users to cause a denial of service daemon crash via a SELECT statement with a ROWNUM condition involving a subquery...

IBM solidDB 6.5.0.8 - 'SELECT' Statement 'WHERE' Condition Denial of Service

source: https://www.securityfocus.com/bid/52111/info IBM solidDB is prone to a denial-of-service vulnerability. Attackers can exploit this issue to crash the affected application, denying service to legitimate users. IBM solidDB versions prior to 6.5.0.8 Interim Fix 6 are vulnerable. SELECT FROM ...

IBM solidDB 6.5.0.8 - SELECT Statement WHERE Condition Denial of Service

IBM solidDB 6.5.0.8 - SELECT Statement WHERE Condition Denial of Service source: https://www.securityfocus.com/bid/52111/info IBM solidDB is prone to a denial-of-service vulnerability. Attackers can exploit this issue to crash the affected application, denying service to legitimate users. IBM...

Aspcms 1.5 COOKIES injection 0day and fix-vulnerability warning-the black bar safety net

Aspcms 1.5 COOKIES injection 0day, register an account. Then after landing to modify the COOKIES of USERID values In the back plus the injected statement: UNION SELECT 1,2,3,4,5,6,username,adminpassword,9,1 0,1 1,1 2,1 3,1 4,1 5,1 6,1 7,1 8,1 9,2 0,2 1,2 2 from Aspcmsadmins Then edit the account...

WordPress Plugin jetpack - 'sharedaddy.php' ID SQL Injection

Exploit Title: WordPress jetpack plugin SQL Injection Vulnerability Date: 2011-19-11 Author: longrifle0x software: Wordpress Download:http://wordpress.org/extend/plugins/jetpack/ Tools: SQLMAP DESCRIPTION Discovered a vulnerability in jetpack, Wordpress Plugin, vulnerability is SQL injection...

WordPress Plugin Glossary - SQL Injection

Exploit Title: WordPress WP Glossary plugin SQL Injection Vulnerability Date: 2011-30-10 Author: longrifle0x software: Wordpress Download: http://wordpress.org/extend/plugins/wp-glossary/ Tools: SQLMAP DESCRIPTIONDiscovered a vulnerability in WP Glossary, Wordpress Plugin, vulnerability is SQL...

Simple Free PHP Forum Script 1 SQL Injection

Exploit Title: Simple Free PHP Forum Script 1,BENCHMARK500000000,MD5CHAR115,113,108,109,97,112,0 AND id='1 wget "http://127.0.0.1/forum/index.php?show=cat&id=1' AND 1=IF21,BENCHMARK500000000,MD5CHAR115,113,108,109,97,112,0 AND id='1" -------------- Vurnerable Code -------------- Line 150 of...

Two Remote Code Execution Vulnerabilities in Internet Explorer

Vulnerability 1: Internet Explorer Select Element Remote Code Execution Original advisory: http://ifsec.blogspot.com/2011/10/internet-explorer-select-element-remote.html I. OVERVIEW There is a vulnerability in Internet Explorer which enables execution of arbitrary code if the user visits a web pa...

Internet Explorer Select Element Cache Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Microsoft Internet Explorer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

Microsoft Internet Explorer Select元素内存破坏漏洞(MS11-081)

BUGTRAQ ID: 49964 CVE ID: CVE-2011-1999 Microsoft Internet Explorer简称MSIE，是微软公司推出的一款网页浏览器。 IE在处理Select元素时在实现上存在内存破坏漏洞，远程攻击者可利用此漏洞远程代码，导致拒绝服务。 Microsoft Internet Explorer 9.x Microsoft Internet Explorer 8.x Microsoft Internet Explorer 7.x Microsoft Internet Explorer 6.x 临时解决方法：...