US-CERT Technical Cyber Security Alert TA04-160A -- SQL Injection Vulnerabilities in Oracle E-Business Suite

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Technical Cyber Security Alert TA04-160A SQL Injection Vulnerabilities in Oracle E-Business Suite Original release date: June 8, 2004 Last revised: -- Source: US-CERT Systems Affected Oracle Applications 11.0 all releases Oracle E-Business Suite 11i,...

jPORTAL 2.2.1 - 'print.php' SQL Injection

source: https://www.securityfocus.com/bid/10430/info JPortal is reportedly affected by a remote SQL injection vulnerability in the print.inc.php script. This issue is due to a failure of the application to properly sanitize user-supplied URI input before using it in an SQL query. As a result of...

[Full-Disclosure] iDEFENSE Security Advisory 03.19.04: Borland Interbase admin.ib Administrative Access Vulnerability

Borland Interbase admin.ib Administrative Access Vulnerability iDEFENSE Security Advisory 03.19.04 www.idefense.com/application/poi/display?id=80&type=vulnerabilities March 19, 2004 I. BACKGROUND Borland Interbase is a small, high performance commercial database for Linux, Solaris, and Windows...

eCommerce Corporation Online Store Kit 3.0 - 'shop_by_brand.php?cat_manufacturer' SQL Injection

source: https://www.securityfocus.com/bid/9687/info It has been reported that Online Store Kit is prone to multiple SQL injection vulnerabilities. These issues arise due to insufficient sanitation of user-supplied input via the URI. As a result of this a malicious user may influence database...

eCommerce Corporation Online Store Kit 3.0 - shop.php?cat SQL Injection

eCommerce Corporation Online Store Kit 3.0 - shop.php?cat SQL Injection source: https://www.securityfocus.com/bid/9687/info It has been reported that Online Store Kit is prone to multiple SQL injection vulnerabilities. These issues arise due to insufficient sanitation of user-supplied input via t...

osCommerce 2.2 - products_id SQL Injection

osCommerce 2.2 - productsid SQL Injection source: https://www.securityfocus.com/bid/9275/info It has been reported that one of the scripts included with osCommerce fails to validate user-supplied input, rendering it vulnerable to a SQL injection attack. It has been reported that an attacker may...

SQL injection vulnerability in phpnuke

Multiple researchers have discovered multiple SQL injection vulnerabilities in some versions of Php-Nuke. These vulnerabilities may lead to information disclosure, compromise of the Php-Nuke site, or compromise of the back-end database...

Improper authentication checking in Alan Ward Acart

Vulnerability: Improper authentication checking for delete Discussion: Due to improper authentication checking a pop-up opened by any of the multiple XSS vulnerabilities by the admin of the site can cause a database compromise. Exploit: By using one of the multiple XSS vulnerabilities in this...

Geeklog 1.3.8 - Forgot Password SQL Injection

source: https://www.securityfocus.com/bid/8849/info An SQL injection vulnerability has been reported in the Geeklog "forgot password" feature introduced in Geeklog 1.3.8. Due to insufficient sanitization of user-supplied input, it is possible for remote attacks to influence database queries. This...

IISProtect 2.12.2 - Web Administration Interface SQL Injection

IISProtect 2.12.2 - Web Administration Interface SQL Injection source: https://www.securityfocus.com/bid/7675/info The IISProtect web administration interface does not properly sanitize user input. This could allow for SQL injection attacks on a Microsoft IIS server running IISProtect. Successful...

Microsoft BizTalk Server 20002002 DTA - rawdocdata.asp SQL Injection

Microsoft BizTalk Server 20002002 DTA - rawdocdata.asp SQL Injection source: https://www.securityfocus.com/bid/7470/info A vulnerability has been reported for BizTalk Server which may make it possible for remote users to modify database query logic. The vulnerability exists in some of the pages...

Microsoft BizTalk Server 20002002 DTA - RawCustomSearchField.asp SQL Injection

Microsoft BizTalk Server 20002002 DTA - RawCustomSearchField.asp SQL Injection source: https://www.securityfocus.com/bid/7470/info A vulnerability has been reported for BizTalk Server which may make it possible for remote users to modify database query logic. The vulnerability exists in some of t...

Microsoft BizTalk Server 2000/2002 DTA - 'rawdocdata.asp' SQL Injection

source: https://www.securityfocus.com/bid/7470/info A vulnerability has been reported for BizTalk Server which may make it possible for remote users to modify database query logic. The vulnerability exists in some of the pages used by the DTA interface. This vulnerability may be the result of...

CVE-2002-0536

This CVE affects PHPGroupware 0.9.12 and earlier. When magic_quotes_gpc is disabled, remote attackers can perform a SQL injection to compromise the database. The issue is caused by insufficient input handling in the affected PHPGroupware deployment, enabling unauthorized access to database data. ...

CVE-2002-0536

PHPGroupware 0.9.12 and earlier, when running with the magicquotesgpc feature disabled, allows remote attackers to compromise the database via a SQL injection attack...

Xpede many vulnerabilities

Xpede C00kb00k // Note As mentionned below in the "vendor status" section, i did not get any reply after 3 mails, asking for acknowledgment and an amount of working time expected before an official patch release. Well, at that time i still have no idea if intellisol/workforceroi is currently...

BorlandInprise Interbase 4.05.06.0 - Backdoor Password

BorlandInprise Interbase 4.05.06.0 - Backdoor Password source: https://www.securityfocus.com/bid/2192/info Interbase is an open source relational database offered by Borland Inprise Corporation. Interbase contains a backdoor user account and password called "LOCKSMITH". When accessed this account...

MySQL 3.22.273.22.293.23.8 - GRANT Global Password Changing

MySQL 3.22.273.22.293.23.8 - GRANT Global Password Changing source: https://www.securityfocus.com/bid/926/info MySQL is a popular RDBMS used by many websites as a back-end. It is possible for users with GRANT access to change passwords for every user in the database including the mysql superuser...

MySQL 3.22.27/3.22.29/3.23.8 - GRANT Global Password Changing

source: https://www.securityfocus.com/bid/926/info MySQL is a popular RDBMS used by many websites as a back-end. It is possible for users with GRANT access to change passwords for every user in the database including the mysql superuser. MySQL also ships with a default "test" account which has...