13421 matches found
web2Project 3.1 SQL Injection
Advisory ID: HTB23213 Product: web2Project Vendor: http://web2project.net Vulnerable Versions: 3.1 and probably prior Tested Version: 3.1 Advisory Publication: April 30, 2014 without technical details Vendor Notification: April 30, 2014 Vendor Patch: May 1, 2014 Public Disclosure: June 18, 2014...
PT-2014-4279
Name of the Vulnerable Software and Affected Versions Symantec Web Gateway versions prior to 5.2.1 Description The issue allows remote authenticated users to execute arbitrary SQL commands. This can be achieved via unspecified vectors in the user.php file of the management console. Recommendation...
PT-2014-4977
Name of the Vulnerable Software and Affected Versions F5 ARX Data Manager versions 3.0.0 through 3.1.0 Description The issue allows remote authenticated users to execute arbitrary SQL commands. This is a result of a SQL injection vulnerability in the web service. Recommendations For F5 ARX Data...
SePortal staticpages SQL Injection (CVE-2008-5191)
An SQL injection vulnerability has been reported in SePortal. A remote attacker may exploit this issue by executing arbitrary SQL commands via the pollid parameter to pool.php and the spid parameter to staticpages.php. Successful exploitation could cause an SQL statement execution on the server,...
Sql injection
Multiple SQL injection vulnerabilities in the file browser component wefs.php in webEdition CMS before 6.2.7-s1.2 and 6.3.x through 6.3.8 before -s1 allow remote attackers to execute arbitrary SQL commands via the 1 table or 2 order parameter...
CVE-2014-4034
SQL injection vulnerability in zeroviewarticle.php in ZeroCMS 1.0 allows remote attackers to execute arbitrary SQL commands via the articleid parameter...
Sql injection
SQL injection vulnerability in zeroviewarticle.php in ZeroCMS 1.0 allows remote attackers to execute arbitrary SQL commands via the articleid parameter...
CVE-2014-4034
SQL injection vulnerability in zeroviewarticle.php in ZeroCMS 1.0 allows remote attackers to execute arbitrary SQL commands via the articleid parameter...
CVE-2014-3287
Affected software : Cisco Unified Communications Manager (Cisco Unified CM) – Java interface, specifically the BulkViewFileContentsAction.java. Vulnerability : SQL injection via crafted filename parameters in a URL, leading to arbitrary SQL execution. Impact : Authenticated, remote attacker could...
Sql injection
SQL injection vulnerability in the checkEmailFormat function in plugins/jojocore/classes/Jojo.php in Jojo before 1.2.2 allows remote attackers to execute arbitrary SQL commands via the X-Forwarded-For HTTP header to /articles/test/...
Sql injection
Multiple SQL injection vulnerabilities in FrontAccounting FA before 2.3.21 allow remote attackers to execute arbitrary SQL commands via unspecified vectors...
PT-2014-5646
Name of the Vulnerable Software and Affected Versions FrontAccounting versions prior to 2.3.21 Description The issue allows remote attackers to execute arbitrary SQL commands, potentially leading to unauthorized data access or modification. Recommendations For versions prior to 2.3.21, update to...
CVE-2014-3973: Improper Neutralization of Special Elements used in an SQL Command
Multiple SQL injection vulnerabilities in FrontAccounting FA before 2.3.21 allow remote attackers to execute arbitrary SQL commands via unspecified vectors...
CVE-2014-3962
Multiple SQL injection vulnerabilities in Videos Tube 1.0 allow remote attackers to execute arbitrary SQL commands via the url parameter to 1 videocat.php or 2 single.php...
CVE-2014-3961
SQL injection vulnerability in the Export CSV page in the Participants Database plugin before 1.5.4.9 for WordPress allows remote attackers to execute arbitrary SQL commands via the query parameter in an "output CSV" action to pdb-signup/...
Medium: lighttpd
Issue Overview: Multiple directory traversal vulnerabilities in 1 modevhost and 2 modsimplevhost in lighttpd before 1.4.35 allow remote attackers to read arbitrary files via a .. dot dot in the host name, related to requestcheckhostname. SQL injection vulnerability in modmysqlvhost.c in lighttpd...
Sql injection
SQL injection vulnerability in the Contextual Related Posts plugin before 1.8.10.2 for WordPress allows remote attackers to execute arbitrary SQL commands via unspecified vectors...
CVE-2014-3937
SQL injection vulnerability in the Contextual Related Posts plugin before 1.8.10.2 for WordPress allows remote attackers to execute arbitrary SQL commands via unspecified vectors...
CVE-2014-3932
SQL injection vulnerability in the device registration component in wsf/webservice.php in CoSoSys Endpoint Protector 4 4.3.0.4 and 4.4.0.2 allows remote attackers to execute arbitrary SQL commands via unspecified parameters...