ASPSitem <= 2.0 Remote (SQL Injection / DB Disclosure) Vulnerabilities

No description provided by source. ASPSitem = 2.0 Multiple Vulnerabilities. Contacts ICQ: 10072 MSN/Mail: [email protected] web: www.nukedx.com This exploits works on ASPSitem = 2.0. Original advisory can be found at: http://www.nukedx.com/?viewdoc=39 SQL injection - GET -...

CVE-2006-2418: Undefined Security Weakness

Cross-site scripting XSS vulnerabilities in certain versions of phpMyAdmin before 2.8.0.4 allow remote attackers to inject arbitrary web script or HTML via the db parameter in unknown scripts...

Invision Power Board v2.1.5 Remote SQL Injection

Invision Power Board v2.1.5 Remote SQL Injection Filename :- funcmod.php Functionname :- postdelete Lines :- 89 To 209 Bug Found By :- Devil-00 Greetz :- Rock Master ^ Hackers Pal ^ n0m4rcy ^ www.securtygurus.net Code if isarray $id if count$id 0 $pid = " IN".implode",",$id.""; else return FALSE;...

magiciso 5.0 build 0166 - Directory Traversal

source: https://www.securityfocus.com/bid/17725/info Reportedly, an attacker can carry out attacks using directory-traversal strings. These issues occur when the application processes malicious archives. A successful attack can allow the attacker to place potentially malicious files and to...

Oracle DB SQL Injection via DBMS_EXPORT_EXTENSION

This module will escalate an Oracle DB user to DBA by exploiting a sql injection bug in the DBMSEXPORTEXTENSION.GETDOMAININDEXMETADATA package. Note: This module has been tested against 9i, 10gR1 and 10gR2. Module Options msf use auxiliary/sqli/oracle/dbms/exportextension msf...

CVE-2006-1764: Undefined Security Weakness

Hosting Controller 6.1 stores forum/db/forum.mdb under the web document root with insufficient access control, which allows remote attackers to obtain sensitive information such as user name and password credentials. NOTE: the provenance of this information is unknown; the details are obtained fr...

GLSA-200603-13 : PEAR-Auth: Potential authentication bypass

The remote host is affected by the vulnerability described in GLSA-200603-13 PEAR-Auth: Potential authentication bypass Matt Van Gundy discovered that PEAR-Auth did not correctly validate data passed to the DB and LDAP containers. Impact : A remote attacker could possibly exploit this vulnerabili...

DEBIAN-CVE-2006-0806

Multiple cross-site scripting XSS vulnerabilities in ADOdb 4.71, as used in multiple packages such as phpESP, allow remote attackers to inject arbitrary web script or HTML via 1 the nextpage parameter in adodb-pager.inc.php and 2 other unspecified vectors related to PHPSELF...

PT-2006-1803 · Dotproject · Dotproject

Name of the Vulnerable Software and Affected Versions: dotProject versions 2.0.1 and earlier Description: The issue allows remote attackers to obtain sensitive information via direct requests with an invalid baseDir to certain PHP scripts in the db directory, which reveal the path in an error...

CVE-2006-0754: Undefined Security Weakness

dotProject 2.0.1 and earlier allows remote attackers to obtain sensitive information via direct requests with an invalid baseDir to certain PHP scripts in the db directory, which reveal the path in an error message. NOTE: the vendor disputes this issue, saying that it could only occur if the...

Oracle Database XML Database SQL Injection vulnerability

Overview Oracle Database XML Database XML DB is vulnerable to SQL injection, possibly allowing a remote attacker to execute arbitrary SQL commands on a vulnerable Oracle installation. Description According to Oracle:Oracle XML DB is a feature of the Oracle Database. It provides a high-performance...

CVE-2005-4241

Cross-site scripting XSS vulnerability in the category page in VCD-db 0.98 and earlier allows remote attackers to inject arbitrary web script or HTML via the batch parameter...

CVE-2005-4240

SQL injection vulnerability in search.php in VCD-db 0.98 and earlier allows remote attackers to execute arbitrary SQL commands via the by parameter...

CVE-2005-4241

Cross-site scripting XSS vulnerability in the category page in VCD-db 0.98 and earlier allows remote attackers to inject arbitrary web script or HTML via the batch parameter...

CVE-2005-4241

The CVE-2005-4241 issue affects VCD-db 0.98 and earlier, with a Cross-site Scripting (XSS) vulnerability on the category page exploited via the batch parameter. Remote attackers could inject arbitrary script/HTML. This entry is supported by multiple sources noting XSS in VCD-db and the affected v...

CVE-2005-4240

SQL injection vulnerability in search.php in VCD-db 0.98 and earlier allows remote attackers to execute arbitrary SQL commands via the by parameter...

CVE-2005-4240

Vulnerability details (CVE-2005-4240): Affected software is VCD-db 0.98 and earlier. The issue is an SQL injection in search.php via the by parameter, allowing remote attackers to execute arbitrary SQL commands. Impact is stated as partial confidentiality/integrity/availability (per CVSS), with n...

CVE-2005-4241: Undefined Security Weakness

Cross-site scripting XSS vulnerability in the category page in VCD-db 0.98 and earlier allows remote attackers to inject arbitrary web script or HTML via the batch parameter...

CVE-2005-4240: Undefined Security Weakness

SQL injection vulnerability in search.php in VCD-db 0.98 and earlier allows remote attackers to execute arbitrary SQL commands via the by parameter...

VCD-db vuln.

VCD-db vuln. Vuln. dicovered by : r0t Date: 13 dec. 2005 orginal advisory:http://pridels.blogspot.com/2005/12/vcd-db-vuln.html vendor: http://vcddb.konni.com/ affected version:V.0.98 and prior Product Description: VCD-db is a Free web based software that lets you manage your DVD/VCD/CDs collectio...