Modify Data via Inline Views

Name Modify Data via Inline Views 8107967 DB09 Systems Affected Oracle 9i - 10g Rel. 2 Severity High Risk Category Unauthorized Access Vendor URL http://www.oracle.com/ Author Alexander Kornbrust ak at red-database-security.com Advisory 18 October 2006 V 1.00 Advisory...

CVE-2006-4103

PHP remote file inclusion vulnerability in article-raw.php in Jason Alexander phNNTP 1.3 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the filenewsportal parameter...

CVE-2006-4103

CVE-2006-4103 describes a PHP remote file inclusion in Jason Alexander’s phNNTP up to version 1.3, where the parameter file_newsportal accepts a URL leading to arbitrary PHP code execution via article-raw.php. The underlying issue is improper inclusion of user-controlled URLs, allowing an attacke...

CVE-2006-4103: Undefined Security Weakness

PHP remote file inclusion vulnerability in article-raw.php in Jason Alexander phNNTP 1.3 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the filenewsportal parameter...

BXCP <= 0.2.9.9 (tid) Remote SQL Injection Exploit

Exploit for unknown platform in category web applications ================================================== BXCP = 0.2.9.9 tid Remote SQL Injection Exploit ================================================== ? errorreportingEERROR; function xssinit if !extensionloaded'phpcurl' if !dl'curl.so' and...

webSPELL 4.01 - 'title_op' SQL Injection

x128.net oo website : www.x128.net"; function xssexploit $xsstarget = $SERVER'argv'1 . "/index.php"; $xsshttpget = "?site=search&action=search";...

crypt_blowfish 1.0

Hi, This is to announce the first mature version of cryptblowfish and the minor security fix that this version adds. cryptblowfish is a public domain implementation of a modern password hashing algorithm based on the Blowfish block cipher, provided via the crypt3 and a reentrant interface. It is...

GLSA-200509-04 : phpLDAPadmin: Authentication bypass

The remote host is affected by the vulnerability described in GLSA-200509-04 phpLDAPadmin: Authentication bypass Alexander Gerasiov discovered a flaw in login.php preventing the application from validating whether anonymous bind has been disabled in the target LDAP server configuration. Impact :...

Simple PHP Blog File Upload and User Credentials Exposure Vulnerabilities

=============================================================================== XOR Crew :: Security Advisory 8/25/2005 =============================================================================== Simple PHP Blog File Upload and User Credentials Exposure Vulnerabilities...

Append file in Oracle Webcache 9i

Name Append file vulnerability in Oracle Webcache 9i Systems Affected Oracle Application Server with Webcache 9i Severity Medium Risk Category Corruption of files Vendor URL http://www.oracle.com Author Alexander Kornbrust ak at red-database-security.com Date 26 Apr 2005 V 1.00 Advisory...

gnomevfs -- unsafe URI handling

Alexander Larsson reports that some versions of gnome-vfs and MidnightCommander contain a number of extfs' scripts that do not properly validate user input. If an attacker can cause her victim to process a specially-crafted URI, arbitrary commands can be executed with the privileges of the victim...

CUPS DoS Bugs

A Debian user thanks, Alexander Hvostov! reported a DoS bug in Debian's CUPS packages cupsys. After working with the vendor on the issue, they subsequently discovered a few more. The original bug, at least, is remotely exploitable. The beta versions of CUPS 1.1 are not vulnurable, at least since...