Oracle 9i10g - Database Fine Grained Audit Logging Failure

Oracle 9i10g - Database Fine Grained Audit Logging Failure source: https://www.securityfocus.com/bid/13510/info Oracle 9i/10g Database is prone to a logging failure vulnerability that exists in Fine Grained Audit FGA functionality. Reports indicate that FGA may be disabled inadvertently, without...

FishCart 3.1 - 'upstnt.php?cartid' SQL Injection

source: https://www.securityfocus.com/bid/13499/info FishCart is prone to multiple cross-site scripting and SQL-injection vulnerabilities because the application fails to properly sanitize user-supplied input. A successful exploit of the SQL-injection issues could allow an attacker to compromise...

CVE-2005-1425

CVE-2005-1425 affects Uguestbook 1.0, where sensitive data is stored under the web root with insufficient access control. Remote attackers can directly request mdb-database/guestbook.mdb to download the database. CVSS v2 base score is 5.0 (Medium) with network attack, low complexity, no authentic...

Cross Site Scripting in Oracle Webcache 9i

Name Cross Site Scripting in Oracle Webcache 9i Systems Affected Oracle Application Server with Webcache 9i Severity Low Risk Category Cross Site Scripting Vendor URL http://www.oracle.com Author Alexander Kornbrust ak at red-database-security.com Date 26 Apr 2005 V 1.00 Advisory AKSEC2003-011 Ti...

[HV-HIGH] Microsoft Jet DB engine vulnerabilities

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Microsoft Jet DB engine vulnerabilities Classification: =============== Level: low-med-HIGH-crit ID: HEXVIEW200503311 URL: http://www.hexview.com/docs/20050331-1.txt Overview: ========= Microsoft Jet database is a lightweight database widely used by M...

ESMI PayPal StoreFront 1.7 - products1.php?id2 SQL Injection

ESMI PayPal StoreFront 1.7 - products1.php?id2 SQL Injection source: https://www.securityfocus.com/bid/12903/info ESMI PayPal Storefront is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in as SQL...

ESMI PayPal StoreFront 1.7 - 'pages.php?idpages' SQL Injection

source: https://www.securityfocus.com/bid/12903/info ESMI PayPal Storefront is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in as SQL query. Successful exploitation could result in a compromise ...

BetaParticle blog 2.03.0 - myFiles.asp File Manipulation

BetaParticle blog 2.03.0 - myFiles.asp File Manipulation source: https://www.securityfocus.com/bid/12861/info betaparticle blog is reported prone to multiple vulnerabilities. The following individual issues are reported: It is reported that betaparticle blog fails to sufficiently secure the...

CVE-2004-1758

BEA WebLogic Server/Express (versions 8.1 up to SP2, 7.0 up to SP4, 6.1 up to SP6) may store the database username and password for an untargeted JDBC connection pool in plaintext in config.xml, enabling local users to gain privileges. Root cause: credentials stored in plaintext within config.xml...

postnuke -- SQL injection vulnerabilities

Two separate SQL injection vulnerabilities have been identified in the PostNuke PHP content management system. An attacker can use this vulnerability to potentially insert executable PHP code into the content management system to view all files within the PHP scope, for instance. Various other SQ...

WebCalendar login.php webcalendar_session Cookie SQL Injection

The remote version of WebCalendar contains a SQL injection vulnerability that may allow an attacker to execute arbitrary SQL statements against the remote database. An attacker may be able to leverage this issue to, for example, delete arbitrary database tables. %NASLMINLEVEL 70300 C Tenable...

CVE-2004-1447

Jetbox One 2.0.8 (and possibly other versions) stores passwords in the database in plaintext, exposing user credentials. Root cause: plaintext credential storage in the data store, enabling potential disclosure if the database is accessed. CVE-2004-1447 is described with a Medium base score (AV:N...

SQL Injection Vulnerability In IBProArcade

A flaw exists in the high scores module of IbProArcade which allows malicious SQL Code to be executed on the database the board & arcade use. Demo: http://www.ibproarcade.com/index.php?act=Arcade&do=stats&gameid=104FOO Fix this vuln by following the following directions... open your...

CVE-2004-2357

The embedded MySQL 4.0 server for Proofpoint Protection Server does not require a password for the root user of MySQL, which allows remote attackers to read or modify the backend database...

Oracle Trigger Abuse (#NISR2122004I)

NGSSoftware Insight Security Research Advisory Name: Oracle 10g/9i Trigger Abuse Systems Affected: Oracle 10g/9i on all operating systems Severity: High risk Vendor URL: http://www.oracle.com/ Author: David Litchfield davidl at ngssoftware.com Relates to:...

Kayako eSupport 2.x - index.php Knowledgebase Cross-Site Scripting

Kayako eSupport 2.x - index.php Knowledgebase Cross-Site Scripting source: https://www.securityfocus.com/bid/12037/info Kayako eSupport is prone to multiple input validation vulnerabilities. One cross-site scripting and six SQL injection vulnerabilities. These issues may collectively threaten...

Kayako eSupport 2.x - 'index.php' Knowledgebase Cross-Site Scripting

source: https://www.securityfocus.com/bid/12037/info Kayako eSupport is prone to multiple input validation vulnerabilities. One cross-site scripting and six SQL injection vulnerabilities. These issues may collectively threaten compromise of software and database security properties. Possible...

CVE-2004-0351

Spider Sales shopping cart stores the private key in the same database and table as the public key, which allows local users with access to the database to decrypt data...

Invision Power Board 2.0 - 'index.php' Post Action SQL Injection

source: https://www.securityfocus.com/bid/11703/info A remote SQL injection vulnerability affects Inivision Power Board. This issue is due to a failure of the application to properly validate user-supplied input prior to using it in an SQL query. An attacker may leverage this issue to manipulate...

CVE-2004-0835

MySQL 3.x before 3.23.59, 4.x before 4.0.19, 4.1.x before 4.1.2, and 5.x before 5.0.1, checks the CREATE/INSERT rights of the original table instead of the target table in an ALTER TABLE RENAME operation, which could allow attackers to conduct unauthorized activities...