Oracle 8 oratclsh Suid Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/159/info Oracle8 is an enterprise level database. As part of the Internet Agent option installation process it installs the file $ORACLEHOME/bin/oratclsh as suid root. oratclsh is a TCL application that provides full acce...

BatmanPorTaL - profil.asp id Parameter SQL Injection

No description provided by source. source: http://www.securityfocus.com/bid/29057/info BatmanPorTaL is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. A successful exploit may allow an attacker to...

EXP Shop 1.0 Joomla! 'com_expshop' Component SQL Injection Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/29869/info The EXP Shop component for Joomla! is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue could allow an...

MGinternet Property Site Manager admin_login.asp Multiple Field SQL Injection

No description provided by source. source: http://www.securityfocus.com/bid/21073/info MGinternet Property Site Manager is prone to multiple input-validation vulnerabilities, including cross-site scripting and SQL-injection issues, because it fails to sufficiently sanitize user-supplied input. An...

X-Scripts X-Protection 1.10 Protect.PHP SQL Injection Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/19235/info X-Protection is prone to an SQL-injection vulnerability because it fails to properly sanitize user-supplied input before using it in an SQL query. A successful exploit could allow an attacker to compromise the...

VideoCMS 3.1 - SQL Injection Vulnerability

No description provided by source. VideoCMS SQL injection vulnerability - id Author : kaMtiEz [email protected] Homepage : http://www.indonesiancoder.com Date : Desember 14, 2009 Software Information + Vendor : http://www.codemight.com/ + version : 3.1 or lower maybe also affected + Vulnerabilit...

ContentServ 3.0/3.1/4.0 Index.PHP SQL Injection Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/15956/info ContentServ is prone to an SQL-injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query. Successful exploitation could...

PHPNuke 4.x/5.x SQL_Debug Information Disclosure Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/3906/info PHPNuke is a website creation/maintenance tool. It is can be back-ended by a number of database products such as MySQL, PostgreSQL, mSQL, Interbase, Sybase, etc. The sqllayer.php script contains a debugging...

Image gallery with Access Database default.asp Multiple Parameter SQL Injection

No description provided by source. source: http://www.securityfocus.com/bid/21131/info Image gallery with Access Database is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting these issues could...

Invision Power Board 2.0/2.1 Index.PHP SQL Injection Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/17839/info Invision Power Board is prone to an SQL-injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query. Successful exploitati...

WordPress Plugin ENL NewsLetter - '/wp-admin/admin.php' SQL Injection

source: https://www.securityfocus.com/bid/68558/info ENL Newsletter plugin for WordPress is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied input. An attacker can exploit this issue to compromise the application, access or modify data, or exploit...

XOOPS Glossaire Module - modulesglossaireglossaire-aff.php SQL Injection

XOOPS Glossaire Module - modulesglossaireglossaire-aff.php SQL Injection source: https://www.securityfocus.com/bid/67460/info Glossaire module for XOOPS is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. An...

74cms 逻辑漏洞导致sql注入

简要描述： 74cms 逻辑漏洞导致sql注入 详细说明： include/funpersonal.php381-398 $j=getresumebasic$uid,$pid; $searchtab'sex'=$j'sex'; $searchtab'nature'=$j'nature'; $searchtab'marriage'=$j'marriage'; $searchtab'experience'=$j'experience'; $searchtab'district'=$j'district'; $searchtab'sdistrict'=$j'sdistrict';...

CVE-2014-0515

creationtimestamp| type| source ---|---|--- 2014-05-06 06:53:49+00:00| seen| MISP/53688689-7c14-4708-a50b-3470950d2109 2014-05-12 00:00:00+00:00| confirmed| https://www.exploit-db.com/exploits/33333 2014-09-08 07:58:27+00:00| seen| MISP/540d6156-d97c-46ec-b14f-490e950d210b 2014-09-19...

Sqlninja Automated SQL Injection tool

Sqlninja is an automated SQL Injection tool. Remote attackers can use Sqlninja to fetch data from the database and execute SQL statements...

Researcher Warns of Critical Flaws in Oracle Servers

There are two vulnerabilities in some of Oracle’s older database packages that allow an attacker to access a remote server without a password and even view the server’s filesystem and dump arbitrary files. Oracle has not released a patch for one of the flaws, even though it was reported by a...

Encrypt password variables

All variables are currently stored in the database with no encryption Exceptions are repository passwords and Bamboo passwords which are irreversibly hashed/salted. ex. : Deployment variables that contain passwords are stored in the database with no encryption. So anyone with access to the databa...

Command School Student Management System - '/sw/admin_subjects.php?id' SQL Injection

source: https://www.securityfocus.com/bid/64707/info Command School Student Management System is prone to the following security vulnerabilities: 1. Multiple SQL-injection vulnerabilities 2. A cross-site request forgery vulnerability 3. A cross-site scripting vulnerability 4. An HTML injection...

shop7z购物系统可插一句话

简要描述： 数据库默认为asp后缀，提供了插一句话的前提，用错误代码方式防止数据库下载，但是可以注释掉错误代码 详细说明： 记事本打开数据库看了下这串代码的大概位置，然后就开始找地方插一句话。 注册一个帐号， 注册信息时随便找个地方填入 ┳ 原型为 3% 然后再到留言处留言，标题填写 ┼攠數畣整爠煥敵瑳∨∣┩愾┼砧 原型为 a 漏洞证明： 测试官网当前版本...

Netin(Knight)content management system vulnerability-vulnerability warning-the black bar safety net

A very cold content management system, for the first time. Background path: netin/Login. asp Default user: admin/netin The default password is:0 0 0 0 0 0/netin2009 Default database:db$snetinb\db$snetin. mdb The default administrator table: BsUser Injection point: http://0day5.com/shownews.asp?id...