2001 matches found
CVE-2004-1447
Jetbox One 2.0.8 (and possibly other versions) stores passwords in the database in plaintext, exposing user credentials. Root cause: plaintext credential storage in the data store, enabling potential disclosure if the database is accessed. CVE-2004-1447 is described with a Medium base score (AV:N...
SQL Injection Vulnerability In IBProArcade
A flaw exists in the high scores module of IbProArcade which allows malicious SQL Code to be executed on the database the board & arcade use. Demo: http://www.ibproarcade.com/index.php?act=Arcade&do=stats&gameid=104FOO Fix this vuln by following the following directions... open your...
CVE-2004-2357
The embedded MySQL 4.0 server for Proofpoint Protection Server does not require a password for the root user of MySQL, which allows remote attackers to read or modify the backend database...
Oracle Trigger Abuse (#NISR2122004I)
NGSSoftware Insight Security Research Advisory Name: Oracle 10g/9i Trigger Abuse Systems Affected: Oracle 10g/9i on all operating systems Severity: High risk Vendor URL: http://www.oracle.com/ Author: David Litchfield davidl at ngssoftware.com Relates to:...
Kayako eSupport 2.x - index.php Knowledgebase Cross-Site Scripting
Kayako eSupport 2.x - index.php Knowledgebase Cross-Site Scripting source: https://www.securityfocus.com/bid/12037/info Kayako eSupport is prone to multiple input validation vulnerabilities. One cross-site scripting and six SQL injection vulnerabilities. These issues may collectively threaten...
Kayako eSupport 2.x - 'index.php' Knowledgebase Cross-Site Scripting
source: https://www.securityfocus.com/bid/12037/info Kayako eSupport is prone to multiple input validation vulnerabilities. One cross-site scripting and six SQL injection vulnerabilities. These issues may collectively threaten compromise of software and database security properties. Possible...
CVE-2004-0351
Spider Sales shopping cart stores the private key in the same database and table as the public key, which allows local users with access to the database to decrypt data...
Invision Power Board 2.0 - 'index.php' Post Action SQL Injection
source: https://www.securityfocus.com/bid/11703/info A remote SQL injection vulnerability affects Inivision Power Board. This issue is due to a failure of the application to properly validate user-supplied input prior to using it in an SQL query. An attacker may leverage this issue to manipulate...
CVE-2004-0835
MySQL 3.x before 3.23.59, 4.x before 4.0.19, 4.1.x before 4.1.2, and 5.x before 5.0.1, checks the CREATE/INSERT rights of the original table instead of the target table in an ALTER TABLE RENAME operation, which could allow attackers to conduct unauthorized activities...
FreezingCold Broadboard - search.asp SQL Injection
FreezingCold Broadboard - search.asp SQL Injection source: https://www.securityfocus.com/bid/11250/info Reportedly BroadBoard Message Board is affected by multiple SQL injection vulnerabilities. These issues are due to a failure of the application to properly sanitize user supplied URI input prio...
CVE-2002-1264
The vulnerability CVE-2002-1264 affects the Oracle iSQL*Plus web application component of Oracle 9 database server. A buffer overflow can be triggered by a long USERID parameter in the isqlplus URL, allowing remote code execution. The description does not specify affected versions beyond Oracle 9...
CVE-2002-1199
The getdbm procedure in ypxfrd allows local users to read arbitrary files, and remote attackers to read databases outside /var/yp, via a directory traversal and symlink attack on the domain and map arguments...
IBM DB2 9.x < 9 Fix Pack 5 Multiple Vulnerabilities
Binary data 4536.prm...
JetboxOne leaves account database unencrypted
Overview JetboxOne does not encrypt information in the account information database. Any user with the ability to query the database may be able to view confidential account information. Description JetboxOne is an open-source content management system that is written in PHP. An information...
Fedora Core 1 : slocate-2.7-4 (2004-059)
Patrik Hornik discovered a vulnerability in Slocate versions up to and including 2.7 where a carefully crafted database could overflow a heap-based buffer. A local user could exploit this vulnerability to gain 'slocate' group privileges and then read the entire slocate database. The Common...
[UNIX] Multiple SQL Injections in JPortal (print.php)
The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com - - promotion The SecuriTeam alerts list - Free, Accurate, Independent. Get your security news from a reliable source...
Firebird buffer overflow
Buffer overflows in gdsinetserver, gdsdrop, and gdslockmgr during environment and command line processing, in database name...
CVE-2003-1213
The default installation of MaxWebPortal 1.30 stores the portal database under the web document root with insecure access control, which allows remote attackers to obtain sensitive information via a direct request to database/db2000.mdb...
Aardvark Topsites < 4.1.0 - Multiple Vulnerabilities
Aardvark Topsites Multiple Vulnerabilities Vendor: Aardvark Industries Product: Aardvark Topsites Version: = 4.1.0 Website: http://www.aardvarkind.com/ BID: 9231 Description: Aardvark Topsites is a popular free PHP topsites script. See URL for details. Plaintext Database Pass Weakness: The login...
Oracle Database Server 9.0.x - Oracle Binary Local Buffer Overflow
// source: https://www.securityfocus.com/bid/8844/info Oracle Database Server 'oracle' binary has been reported prone to a local buffer overflow vulnerability. The issue likely presents itself due to a lack of sufficient boundary checks performed on command line arguments passed to the affected...