DEBIAN-CVE-2006-0459

flex.skl in Will Estes and John Millaway Fast Lexical Analyzer Generator flex before 2.5.33 does not allocate enough memory for grammars containing 1 REJECT statements or 2 trailing context rules, which causes flex to generate code that contains a buffer overflow that might allow context-dependen...

PT-2006-1525 · Gnu · Flex

Name of the Vulnerable Software and Affected Versions: flex versions prior to 2.5.33 Description: The issue is related to the allocation of memory for grammars containing REJECT statements or trailing context rules. This causes the generation of code that contains a buffer overflow, which might...

CVE-2006-0459: Improper Restriction of Operations within the Bounds of a Memory Buffer

flex.skl in Will Estes and John Millaway Fast Lexical Analyzer Generator flex before 2.5.33 does not allocate enough memory for grammars containing 1 REJECT statements or 2 trailing context rules, which causes flex to generate code that contains a buffer overflow that might allow context-dependen...

Code injection

TWiki 4.0, 4.0.1, and 20010901 through 20040904 allows remote authenticated users with edit rights to cause a denial of service infinite recursion leading to CPU and memory consumption via INCLUDE by URL statements that form a loop, such as a page that includes itself...

Buffer overflow

Oracle Database 8i, 9i, and 10g allow remote authenticated users to execute arbitrary SQL statements in the context of the SYS user and bypass audit logging, including statements to create new privileged database accounts, via a modified AUTHALTERSESSION attribute in the authentication phase of t...

CVE-2006-0547

Oracle Database 8i, 9i, and 10g allow remote authenticated users to execute arbitrary SQL statements in the context of the SYS user and bypass audit logging, including statements to create new privileged database accounts, via a modified AUTHALTERSESSION attribute in the authentication phase of t...

Oracle TNS protocol fails to properly validate authentication requests

Overview The Oracle TNS protocol authentication mechanism fails to properly sanitize authentication requests, possibly allowing a remote attacker to execute arbitrary SQL statements with elevated privileges. Description Oracle databases authenticate and manage database connections via Oracle...

JPORTAL Multiple SQL Injection

DATE: ========= 3/11/2005 AFFECTED PRODUCTS ================= JPORTAL all version OVERVIEW ======== JpoRtaL is a simple portal system written in PHP using MySQL on backend. It includes article posting with comments, topics, links manager with section, download manager with section, short news...

WebCalendar SQL Injection (Nov 2005) - Active Check

The remote installation of WebCalendar may allow an attacker to cause an SQL Injection vulnerability in the program allowing an attacker to cause the program to execute arbitrary SQL statements. SPDX-FileCopyrightText: 2004 Noam Rathaus Some text descriptions might be excerpted from a referenced...

PlaySMS Cookie SQL Injection

PlaySMS is a full-featured SMS gateway application that features sending of single or broadcast SMSes, the ability to receive and forward SMSes, an SMS board, an SMS polling system, SMS customs for handling incoming SMSes and forwarding them to custom applications, and SMS commands for...

IBProArcade index.php SQL Injection

One of the ibProArcade SPDX-FileCopyrightText: 2004 Ami Chayun Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptoid"1.3.6.1.4.1.25623.1.0.16086";...

vBulletin 'last10.php' SQLi Vulnerability - Active Check

The installed version of last10.php may allow an attacker to cause an SQL injection SQLi vulnerability allowing an attacker to cause the program to execute arbitrary SQL statements. SPDX-FileCopyrightText: 2004 Noam Rathaus Some text descriptions might be excerpted from a referenced sources, and...

CVE-2005-3202

Multiple cross-site scripting XSS vulnerabilities in Oracle HTML DB HTMLDB 1.3 through 1.3.6 allow remote attackers to inject arbitrary web script or HTML, and subsequently execute SQL statements via the 1 p or 2 pt02 parameters...

irb, ruby security update

CentOS Errata and Security Advisory CESA-2005:799 Updated ruby packages that fix an arbitrary command execution issue are now available. This update has been rated as having moderate security impact by the Red Hat Security Response Team. Updated 25 Oct 2005 Errata has been updated to include...

Oracle HTML DB 1.5/1.6 - 'f?p=' Cross-Site Scripting

source: https://www.securityfocus.com/bid/15031/info Oracle HTML DB is prone to cross-site scripting vulnerabilities. An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. An attacker can leverage...

Oracle HTML DB 1.51.6 - f?p Cross-Site Scripting

Oracle HTML DB 1.51.6 - f?p Cross-Site Scripting source: https://www.securityfocus.com/bid/15031/info Oracle HTML DB is prone to cross-site scripting vulnerabilities. An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context...

CVE-2005-2778

SQL injection vulnerability in member.php in MyBulletinBoard MyBB allows remote attackers to execute arbitrary SQL statements via the fid parameter...

phpWebSite: Arbitrary command execution through XML-RPC and SQL injection

Background phpWebSite is a web site content management system. Description phpWebSite uses an XML-RPC library that improperly handles XML-RPC requests and responses with malformed nested tags. Furthermore, "matrixkiller" reported that phpWebSite is vulnerable to an SQL injection attack. Impact A...

GLSA-200508-13 : PEAR XML-RPC, phpxmlrpc: New PHP script injection vulnerability

The remote host is affected by the vulnerability described in GLSA-200508-13 PEAR XML-RPC, phpxmlrpc: New PHP script injection vulnerability Stefan Esser of the Hardened-PHP Project discovered that the PEAR XML-RPC and phpxmlrpc libraries were improperly handling XMLRPC requests and responses wit...

Debian DSA-789-1 : php4 - several vulnerabilities

Several security related problems have been found in PHP4, the server-side, HTML-embedded scripting language. The Common Vulnerabilities and Exposures project identifies the following problems : - CAN-2005-1751 Eric Romang discovered insecure temporary files in the shtool utility shipped with PHP...