GLSA-200507-03 : phpBB: Arbitrary command execution

The remote host is affected by the vulnerability described in GLSA-200507-03 phpBB: Arbitrary command execution Ron van Daal discovered that phpBB contains a vulnerability in the highlighting code. Impact : Successful exploitation would grant an attacker unrestricted access to the PHP exec or...

WordPress 1.5.1.2 - xmlrpc Interface SQL Injection

WordPress 1.5.1.2 - xmlrpc Interface SQL Injection !/usr/bin/perl -w sorry for the late posting, had to test it. /str0ke Wordpress 1.5.1.2 Strayhorn // XMLRPC Interface SQL Injection By James Bercegay // http://www.gulftech.org/ // June 21 2005 Quick and dirty proof of concept that uses the XML R...

CVE-2002-1742: Undefined Security Weakness

SOAP::Lite 0.50 through 0.52 allows remote attackers to load arbitrary Perl functions by suppling a non-existent function in a script using a SOAP::Lite module, which causes the AUTOLOAD subroutine to trigger...

lpanelPlain.txt

Subject: Lpanel.NET's Lpanel all versions up to and including 1.59 is vulnerable to plain-text session credential leakage via script injection. Severity: High; Full access to all client functions can be obtained with little effort, putting entire installations of the software and its users at ris...

WordPress 'template-functions-category.php' 'cat_ID' Parameter SQL Injection

The version of WordPress installed on the remote host fails to properly sanitize user-supplied input to the 'catID' variable in the 'template-functions-category.php' script. This failure may allow an attacker to influence database queries resulting in the disclosure of sensitive information. Note...

security flaw

The tsearch2 module in PostgreSQL 7.4 through 8.0.x declares the 1 dexinit, 2 snbeninit, 3 snbruinit, 4 spellinit, and 5 syninit functions as "internal" even when they do not take an internal argument, which allows attackers to cause a denial of service application crash and possibly have other...

CVE-2005-1810

SQL injection vulnerability in template-functions-category.php in WordPress 1.5.1 allows remote attackers to execute arbitrary SQL commands via the $catID variable, as demonstrated using the cat parameter to index.php...

CVE-2005-1810

SQL injection vulnerability in template-functions-category.php in WordPress 1.5.1 allows remote attackers to execute arbitrary SQL commands via the $catID variable, as demonstrated using the cat parameter to index.php...

DEBIAN-CVE-2005-1810

SQL injection vulnerability in template-functions-category.php in WordPress 1.5.1 allows remote attackers to execute arbitrary SQL commands via the $catID variable, as demonstrated using the cat parameter to index.php...

CVE-2005-1810: Undefined Security Weakness

SQL injection vulnerability in template-functions-category.php in WordPress 1.5.1 allows remote attackers to execute arbitrary SQL commands via the $catID variable, as demonstrated using the cat parameter to index.php...

Blue Coat Reporter 7.0/7.1 - Privilege Escalation

source: https://www.securityfocus.com/bid/13723/info Blue Coat Reporter is prone to a remote privilege escalation vulnerability. This issue is due to a failure in the application to properly authenticate a user prior to permitting access to administrator functions. A remote authenticated user can...

CVE-2003-1208

Multiple buffer overflows in Oracle 9i 9 before 9.2.0.3 allow local users to execute arbitrary code by 1 setting the TIMEZONE session parameter to a long value, or providing long parameters to the 2 NUMTOYMINTERVAL, 3 NUMTODSINTERVAL or 4 FROMTZ functions...

USN-118-1: PostgreSQL vulnerabilities

It was discovered that unprivileged users were allowed to call internal character conversion functions. However, since these functions were not designed to be safe against malicious choices of argument values, this could potentially be exploited to execute arbitrary code with the privileges of th...

CVE-2005-1407

CVE-2005-1407 affects Skype for Windows versions 1.2.0.0 through 1.2.0.46. The issue allows a local user to bypass the identity check for an authorized application and then call arbitrary Skype API functions by modifying or replacing that application. The underlying impact is limited to a local e...

CVE-2005-1409

PostgreSQL 7.3.x through 8.0.x gives public EXECUTE access to certain character conversion functions, which allows unprivileged users to call those functions with malicious values, with unknown impact, aka the "Character conversion vulnerability."...

CVE-2005-1407: Undefined Security Weakness

Skype for Windows 1.2.0.0 to 1.2.0.46 allows local users to bypass the identity check for an authorized application, then call arbitrary Skype API functions by modifying or replacing that application...

CVE-2005-1409: Undefined Security Weakness

PostgreSQL 7.3.x through 8.0.x gives public EXECUTE access to certain character conversion functions, which allows unprivileged users to call those functions with malicious values, with unknown impact, aka the "Character conversion vulnerability."...

CVE-2005-1121

Format string vulnerability in the myxlog function in lib.c for Oops! Proxy Server 1.5.23 and earlier, as called by the auth functions in the passwdmysql and passwdpgsql modules, may allow attackers to execute arbitrary code via a URL...

postgresql -- character conversion and tsearch2 vulnerabilities

The postgresql development team reports: The more severe of the two errors is that the functions that support client-to-server character set conversion can be called from SQL commands by unprivileged users, but these functions are not designed to be safe against malicious choices of argument...

Oracle Database PL/SQL Statement Multiple SQL Injection Exploits

Exploit for unknown platform in category local exploits ================================================================ Oracle Database PL/SQL Statement Multiple SQL Injection Exploits ================================================================ / Advanced SQL Injection in Oracle databases...