Synology Video Station 1.5-0757 - Multiple Vulnerabilities

------------------------------------------------------------------------ Synology Video Station command injection and multiple SQL injection vulnerabilities ------------------------------------------------------------------------ Han Sahin, September 2015...

Amazon Linux: Security Advisory (ALAS-2015-464)

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Unspecified Vulnerability in Oracle E-Business Oracle Applications DBA Component

Oracle E-Business Suite is a new generation of e-business suite from Oracle. A security vulnerability exists in the Oracle E-Business Suite Oracle Applications DBA component that can be exploited by remote attackers to compromise system confidentiality...

Design/Logic Flaw

Unspecified vulnerability in the Oracle Applications DBA component in Oracle E-Business Suite 12.2.3 allows remote authenticated users to affect confidentiality via unknown vectors related to AD Utilities...

CVE-2015-4743

CVE-2015-4743 affects Oracle E-Business Suite 12.2.3, specifically the Oracle Applications DBA component. The vulnerability allows remote authenticated users to affect confidentiality via unknown vectors related to AD Utilities. The connected sources corroborate a disclosed vulnerability in this ...

Oracle E-Business Multiple Vulnerabilities (July 2015 CPU)

The version of Oracle E-Business installed on the remote host is missing the July 2015 Oracle Critical Patch Update CPU. It is, therefore, affected by affected by vulnerabilities in the following components : - Oracle Application Object Library CVE-2015-2618 - Oracle Application Object Library...

青果教务系统高危无限制注射(影响海量学校)

简要描述： 这么严重的SQL注射；青果会来确认吗？ 详细说明： 青果某系统存在无限制SQL注射；居然没有见到传说中的WAF拦截；并且大部分可以使用SQLMAP自动化注入测试工具进行测试；并且均为DBA权限；危害极大！ SQL Injection： /data/indexLOGIN.aspx 学生登录时UserID参数存在SQL注射漏洞 Case: 99%以上都是存在该漏洞；我想我该Mask一下保护这些学生！审核员你说呢？ 手工 1、...

某高校在用系统SQL注入（DBA）（无需登录）2-5

简要描述： ·· 详细说明： WooYun: 某高校在用系统sql注入（打包）（DBA）（无需登录）2 上一发 注入文件参数：language.asp editLangCode 案例 202.195.243.37/tasi/admin/system/language.asp --data "editLangCode=SS&editLangName=SS&langid=&action=add&btnSaveLang=%B1%A3%B4%E6" -p editLangCode 202.120.121.200/tasi/admin/system/language.asp --data...

通达oa2013又一奇葩注入DBA

简要描述： 无语了。。。 详细说明： 官网demo登录试用: http://www.day900.com/ 发现这个: http://www.day900.com/general/crm/apps/crm/include/search.php?ENTITY=crmmarketing&PAGESIZE=10&CURPAGE=&ORDERFIELD=&ORDERTYPE=&USERVIEW=1706 payload:ENTITY=crmmarketing' 返回这个: 请联系管理员 错误1064: You have an error in your SQL syntax; check the...

Oracle E-Business Multiple Vulnerabilities (January 2015 CPU)

The version of Oracle E-Business installed on the remote host is missing the January 2015 Oracle Critical Patch Update CPU. It is, therefore, affected by vulnerabilities in the following components : - Oracle Application Object Library - Oracle Applications DBA - Oracle Applications DBA - Oracle...

Unspecified Vulnerability in Oracle E-Business Suite Oracle Applications DBA Component

Oracle E-Business Suite is a new generation of e-business suite from Oracle. A security vulnerability exists in the Oracle E-Business Suite Oracle Applications DBA component that could be exploited by remote attackers to compromise system confidentiality, integrity, and availability...

CVE-2015-0393

Unspecified vulnerability in the Oracle Applications DBA component in Oracle E-Business Suite 11.5.10.2, 12.0.6, 12.1.3, 12.2.2, 12.2.3, and 12.2.4 allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors related to DB Privileges. NOTE: the...

Design/Logic Flaw

Unspecified vulnerability in the Oracle Applications DBA component in Oracle E-Business Suite 11.5.10.2, 12.0.6, 12.1.3, 12.2.2, 12.2.3, and 12.2.4 allows remote authenticated users to affect confidentiality, integrity, and availability via vectors related to ADDDL...

某投稿系统存在DBA Post Sql Injection漏洞

简要描述： 搜了一下没重复就提交来了，几乎为sa用户。所以危害非常的大！！！另外想说这个技术支持是通用的！ 详细说明： 这个投稿系统比较多人使用，希望上报一下修复。 厂商：http://cnc.025journal.com/Web/CommonPage.aspx?Id=1 南京杰诺瀚软件科技有限公司 Google: SQL注入点： web/KeySearch.aspx?searchid=181478 POST数据：operat=Search&state=&keyword=1&title=2&author=3&Nian=&Qi=&Lm= 注入参数是：author 漏洞证明：...

某投稿系统通用型SQL注射漏洞（影响众多企事业单位及学校）

简要描述： 某投稿系统通用型SQL注射漏洞 详细说明： 南京杰诺瀚软件科技有限公司的投稿系统SQL注射漏洞 intitle:投稿系统 技术支持：南京杰诺瀚软件科技有限公司 Web/Login.aspx 页面的 username 参数存在问题 DBA 权限注射 URL:...

Medium: php54

Issue Overview: acinclude.m4, as used in the configure script in PHP 5.5.13 and earlier, allows local users to overwrite arbitrary files via a symlink attack on the /tmp/phpglibccheck file. A denial of service flaw was found in the way the File Information fileinfo extension parsed certain...

Oracle 9i/10g DBMS_METADATA.GET_DDL - SQL Injection Exploit (2)

No description provided by source. !/usr/bin/perl Remote Oracle DBMSMETADATA.GETDDL exploit 9i/10g - Version 2 - New evil cursor injection tip! - No create procedure privileg needed! - See: http://www.databasesecurity.com/ Cursor Injection Grant or revoke dba permission to unprivileged user Teste...

Oracle 10g KUPV$FT.ATTACH_JOB - SQL Injection Exploit (2)

No description provided by source. !/usr/bin/perl Remote Oracle KUPV$FT.ATTACHJOB exploit 10g - Version 2 - New evil cursor injection tip! - No create procedure privileg needed! - See: http://www.databasesecurity.com/ Cursor Injection Grant or revoke dba permission to unprivileged user Tested on...

Oracle Database Server 8.1.7/9.0.x ctxsys.driload Access Validation Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/11099/info Oracle Database Server is prone to an access validation vulnerability that may permit unprivileged users to execute commands as the DBA. This could compromise the database. SQL exec ctxsys.driload.validatestmt...

Oracle 11g Multiple Remote Privilege Escalation Vulnerabilities

No description provided by source. source: http://www.securityfocus.com/bid/38115/info Oracle Database is prone to multiple remote privilege-escalation issues because it fails to properly restrict access to certain packages. The attacker can exploit these issues to escalate their privileges to DB...