CVE-2007-2113

SQL injection vulnerability in the Upgrade/Downgrade component DBMSUPGRADEINTERNAL for Oracle Database 10.1.0.5 allows remote authenticated users to execute arbitrary SQL commands via unknown vectors, aka DB07. NOTE: as of 20070424, Oracle has not disputed reliable claims that DB07 is actually fo...

CVE-2007-2113

CVE-2007-2113 affects Oracle Database (Upgrade/Downgrade component, DBMS_UPGRADE_INTERNAL) and is described as a SQL injection vulnerability in Oracle Database 10.1.0.5. The issue allows remote authenticated users to execute arbitrary SQL via unknown vectors; the description notes this DB07 may c...

CVE-2007-2118

The CVE-2007-2118 entry concerns Oracle Database Upgrade/Downgrade component vulnerabilities in 9.0.1.5 and 9.2.0.7. The description indicates an unspecified vulnerability with unknown impact/attack vectors, and a note that claims this may be a buffer overflow in the mig utility. No additional te...

CVE-2007-2113

SQL injection vulnerability in the Upgrade/Downgrade component DBMSUPGRADEINTERNAL for Oracle Database 10.1.0.5 allows remote authenticated users to execute arbitrary SQL commands via unknown vectors, aka DB07. NOTE: as of 20070424, Oracle has not disputed reliable claims that DB07 is actually fo...

CVE-2007-2118: Undefined Security Weakness

Unspecified vulnerability in the Upgrade/Downgrade component of Oracle Database 9.0.1.5 and 9.2.0.7 has unknown impact and attack vectors, aka DB13. NOTE: as of 20070424, Oracle has not disputed reliable claims that this is a buffer overflow involving the "mig utility."...

Downgrading the Oracle native authentication

Summary ========== Oracle native authentication protocols are typical challenge-response protocols. After some negotiation the client sends the username. If the user exists the server sends an encrypted key. The client uses the key to encrypt the user's password and sends it to the server. One of...

Oracle authentication downgrade

It's possible for man-in-the-middle to force client and server to use weaker authentication protocol...

CVE-2006-3705: Undefined Security Weakness

Multiple unspecified vulnerabilities in Oracle Database 10.1.0.5 have unknown impact and attack vectors, aka Oracle Vuln 1 DB21 for Statistics and 2 DB22 for Upgrade & Downgrade. NOTE: as of 20060719, Oracle has not disputed a claim by a reliable researcher that DB21 is for a local SQL injection...

Quagga ripd multiple vulnerabilities

RIPv1 downgrade attack is possible even if RIPv2 is only configured protocol. RIPv1 protocol is insecure by design...

CVE-2006-0271

Unspecified vulnerability in the Upgrade & Downgrade component of Oracle Database server 8.1.7.4, 9.0.1.5, 9.2.0.7, and 10.1.0.4 has unspecified impact and attack vectors, as identified by Oracle Vuln DB28. NOTE: details are unavailable from Oracle, but they have not publicly disputed a claim by ...

CVE-2006-0271

Unspecified vulnerability in the Upgrade & Downgrade component of Oracle Database server 8.1.7.4, 9.0.1.5, 9.2.0.7, and 10.1.0.4 has unspecified impact and attack vectors, as identified by Oracle Vuln DB28. NOTE: details are unavailable from Oracle, but they have not publicly disputed a claim by ...

CVE-2006-0271: Undefined Security Weakness

Unspecified vulnerability in the Upgrade & Downgrade component of Oracle Database server 8.1.7.4, 9.0.1.5, 9.2.0.7, and 10.1.0.4 has unspecified impact and attack vectors, as identified by Oracle Vuln DB28. NOTE: details are unavailable from Oracle, but they have not publicly disputed a claim by ...

Multiple Windows wireless adapters WEP protection bypass

Atacker can force client to downgradte to unencrypted cleartext mode operations...

openssl mitm downgrade attack

The SSL/TLS server implementation in OpenSSL 0.9.7 before 0.9.7h and 0.9.8 before 0.9.8a, when using the SSLOPMSIESSLV2RSAPADDING option, disables a verification step that is required for preventing protocol version rollback attacks, which allows remote attackers to force a client and server to u...

CVE-2005-3402: Undefined Security Weakness

The SMTP client in Mozilla Thunderbird 1.0.5 BETA, 1.0.7, and possibly other versions, does not notify users when it cannot establish a secure channel with the server, which allows remote attackers to obtain authentication information without detection via a man-in-the-middle MITM attack that...

DEBIAN-CVE-2005-2969

The SSL/TLS server implementation in OpenSSL 0.9.7 before 0.9.7h and 0.9.8 before 0.9.8a, when using the SSLOPMSIESSLV2RSAPADDING option, disables a verification step that is required for preventing protocol version rollback attacks, which allows remote attackers to force a client and server to u...

CVE-2005-2969

The SSL/TLS server implementation in OpenSSL 0.9.7 before 0.9.7h and 0.9.8 before 0.9.8a, when using the SSLOPMSIESSLV2RSAPADDING option, disables a verification step that is required for preventing protocol version rollback attacks, which allows remote attackers to force a client and server to u...

Mozilla Thunderbird / Mozilla weak authentication downgrade

If SMTP authentication with CRAM-MD5 or TLS hadshake fails mail agent downgrades to plain text authentication, allowing active man-in-the-middle attacks...

openssl mitm downgrade attack

The SSL/TLS server implementation in OpenSSL 0.9.7 before 0.9.7h and 0.9.8 before 0.9.8a, when using the SSLOPMSIESSLV2RSAPADDING option, disables a verification step that is required for preventing protocol version rollback attacks, which allows remote attackers to force a client and server to u...

CVE-2001-1444

The Kerberos Telnet protocol, as implemented by KTH Kerberos IV and Kerberos V Heimdal, does not encrypt authentication and encryption options sent from the server, which allows remote attackers to downgrade authentication and encryption mechanisms via a man-in-the-middle attack...