CVE-2007-6635

FAQMasterFlexPlus, possibly 1.5 or 1.52, stores the admin password in cleartext in a database, which might allow context-dependent attackers to obtain the password via unspecified database access...

CVE-2007-6635: Undefined Security Weakness

FAQMasterFlexPlus, possibly 1.5 or 1.52, stores the admin password in cleartext in a database, which might allow context-dependent attackers to obtain the password via unspecified database access...

CVE-2007-6635

FAQMasterFlexPlus, possibly 1.5 or 1.52, stores the admin password in cleartext in a database, which might allow context-dependent attackers to obtain the password via unspecified database access...

CVE-2007-6635

FAQMasterFlexPlus (likely Version 1.5 or 1.52) stores the admin password in cleartext in a database. The underlying issue is the insecure storage of credentials, enabling context-dependent attackers who gain access to the database to obtain the password. The documents do not specify additional af...

[HSC Security Group] Multiple CSRF in Joomla all versions - Complete compromise

HSC Multiple CSRF in Joomla all versions - Complete compromise Hackers Center Security Group http://www.hackerscenter.com Credit: Armando Romeo aka Zinho Class: CSRF Remote: Yes Risk: HIGH Product: Joomla Version: All 1.0.13 and 1.5 rc3 tested Vendor: http://www.joomla.com Patch: Joomla 1.5 RC4...

Buffer overflow

The Oracle database component in Sun Management Center Sun MC 3.6.1, 3.6, and 3.5 Update 1 has a default account, which allows remote attackers to obtain database access and execute arbitrary code...

CVE-2007-6480

The Oracle database component in Sun Management Center Sun MC 3.6.1, 3.6, and 3.5 Update 1 has a default account, which allows remote attackers to obtain database access and execute arbitrary code...

CVE-2007-6330

Meridian Prolog Manager 2007, and 7.5 and earlier, sends all usernames and passwords to the client in a 1 cleartext or 2 weakly encrypted format to support client-side login authentication, which makes it easier for remote attackers to obtain database access by capturing credentials via a...

CVE-2007-6330

Meridian Prolog Manager 2007 and earlier versions (including 7.5 and prior) transmit all usernames and passwords to the client in cleartext or weakly encrypted form to support client-side authentication. This can enable an attacker to capture credentials via network sniffing or a man-in-the-middl...

Beehive论坛post.php脚本远程SQL注入漏洞

BUGTRAQ ID: 26492 CVECAN ID: CVE-2007-6014 Beehive Forum是用PHP编写的开源Web论坛应用。 Beehive Forum实现上存输入验证漏洞，远程攻击者可能利用此漏洞执行SQL注入攻击，非授权操作数据库获取敏感信息。 Beehive论坛的post.php脚本没有正确地过滤用户对tdedupe变量的输入便将该变量的值包含在了SQL语句中并由@mysqlquery函数执行。这个函数经过了特别的设计禁止在单个调用中使用多个SQL语句以缓解SQL注入攻击的影响，但攻击者仍可以通过tdedupe变量操控SQL语句，从数据库获得任意数据。...

Wordpress Cookie Authentication Vulnerability

Wordpress Cookie Authentication Vulnerability Original release date: 2007-11-19 Last revised: 2007-11-19 Latest version: http://www.cl.cam.ac.uk/users/sjm217/advisories/wordpress-cookie-auth.txt CVE ID: pending Source: Steven J. Murdoch http://www.cl.cam.ac.uk/users/sjm217/ Systems Affected:...

CVE-2007-6013: Use of a Broken or Risky Cryptographic Algorithm

Wordpress 1.5 through 2.3.1 uses cookie values based on the MD5 hash of a password MD5 hash, which allows attackers to bypass authentication by obtaining the MD5 hash from the user database, then generating the authentication cookie from that hash...

myspaceclone-sql.txt

--==+================================================================================+==-- --==+ Myspace Clone Script SQL Injection Vulnerabilitys +==-- --==+================================================================================+==-- AUTHOR: t0pP8uZz & xprog SITE: datecomm.com DORK...

LedgerSMB < 1.2.8, SQL-Ledger 2.x Multiple SQL Injection Issues

Severity: Critical Effect: Compromise of FInancial Data, deletion of audit trails, alteration of system settings, disclosure of confidential information possible in some setups. Affected products: LedgerSMB 1.0.0-1.2.7 , SQL-Ledger 2.x all versions. 1: SQL injection issue in invoice quantity fiel...

Administrators joke with administrator privileges upload vulnerability analysis-vulnerability warning-the black bar safety net

These two days are very boring, taking advantage of the holiday time ready to practice under their own invasion of technology, there is nothing the target is ready to test next week around the University site the security, the way to get the website to practice your hand. Most of the administrato...

Levent Veysi Portal 1.0 - Oku.asp SQL Injection

Levent Veysi Portal 1.0 - Oku.asp SQL Injection source: https://www.securityfocus.com/bid/24794/info Levent Veysi Portal is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. An attacker can exploit this issue by...

Code injection

Papoo CMS 3.6, and possibly earlier, does not verify user privileges when accessing the backend administration plugins, which allows remote authenticated users to 1 read the entire database by accessing the database backup plugin via a devtools/templates/newdumpbackend.html argument in the templa...

CVE-2007-3494

Papoo CMS 3.6, and possibly earlier, does not verify user privileges when accessing the backend administration plugins, which allows remote authenticated users to 1 read the entire database by accessing the database backup plugin via a devtools/templates/newdumpbackend.html argument in the templa...

PHPAccounts 0.5 - index.php Multiple SQL Injections

PHPAccounts 0.5 - index.php Multiple SQL Injections source: https://www.securityfocus.com/bid/24574/info PHP Accounts is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue could allow ...

PT-2007-4557 · Postgresql +1 · Postgresql +1

Name of the Vulnerable Software and Affected Versions: PostgreSQL versions 8.1 and later Description: The issue allows remote attackers to access arbitrary accounts and execute arbitrary SQL queries. This is possible when local trust authentication is enabled and the Database Link library dblink ...