Digital Security Research Group [DSecRG] Advisory #DSECRG-09-003

Digital Security Research Group DSecRG Advisory DSECRG-09-003 Application: Oracle database 11G Versions Affected: Oracle 11.1.0.6 and 10.2.0.1 Vendor URL: http://oracle.com Bugs: PL/SQL Injections Exploits: YES Reported: 17.11.2008 Vendor response: 18.11.2008 Last response: 24.11.2008 Date of...

Oracle Database 11G PL/SQL Injection

Digital Security Research Group DSecRG Advisory DSECRG-09-003 Application: Oracle database 11G Versions Affected: Oracle 11.1.0.6 and 10.2.0.1 Vendor URL: http://oracle.com Bugs: PL/SQL Injections Exploits: YES Reported: 17.11.2008 Vendor response: 18.11.2008 Last response: 24.11.2008 Date of...

Oracle Database 11g — EXFSYS PL/SQL injection vulnerability

Application: Oracle database 11G Versions Affected: Oracle 11.1.0.6 and 10.2.0.1 Vendor URL: http://oracle.com Bugs: PL/SQL Injections Exploits: YES Reported: 17.11.2008 Vendor response: 18.11.2008 Last response: 24.11.2008 Date of Public Advisory: 13.01.2009 Author: Alexandr Polyakov Description...

Team SHATTER Security Advisory: Oracle Database SQL Injection in SYS.DBMS_CDC_IPUBLISH.ALTER_HOTLOG_INTERNAL_CSOURCE

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Team SHATTER Security Advisory Oracle Database SQL Injection in SYS.DBMSCDCIPUBLISH.ALTERHOTLOGINTERNALCSOURCE November 12, 2008 Risk Level: Medium Affected versions: Oracle Database Server versions 10gR1, 10gR2 and 11gR1 Remote exploitable: Yes...

Oracle DB SQL Injection via SYS.LT.MERGEWORKSPACE

This module exploits a sql injection flaw in the MERGEWORKSPACE procedure of the PL/SQL package SYS.LT. Any user with execute privilege on the vulnerable package can exploit this vulnerability. Module Options msf use auxiliary/sqli/oracle/lt/mergeworkspace msf undefinedmergeworkspace show actions...

Oracle DB SQL Injection via SYS.LT.COMPRESSWORKSPACE

This module exploits an sql injection flaw in the COMPRESSWORKSPACE procedure of the PL/SQL package SYS.LT. Any user with execute privilege on the vulnerable package can exploit this vulnerability. Module Options msf use auxiliary/sqli/oracle/lt/compressworkspace msf undefinedcompressworkspace sh...

Oracle DB SQL Injection via SYS.LT.REMOVEWORKSPACE

This module exploits a sql injection flaw in the REMOVEWORKSPACE procedure of the PL/SQL package SYS.LT. Any user with execute privilege on the vulnerable package can exploit this vulnerability. Module Options msf use auxiliary/sqli/oracle/lt/removeworkspace msf undefinedremoveworkspace show...

FreeBSD Ports: pl-ekg

The remote host is missing an update to the system as announced in the referenced advisory. VID 9a035a56-eff0-11d9-8310-0001020eed82 OpenVAS Vulnerability Test $ Description: Auto generated from vuxml or freebsd advisories Authors: Thomas Reinke Copyright: Copyright c 2008 E-Soft Inc...

FreeBSD Ports: pl-ekg

The remote host is missing an update to the system as announced in the referenced advisory. SPDX-FileCopyrightText: 2008 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

Team SHATTER Security Advisory: SQL Injection in Oracle Application Server (WWEXP_API_ENGINE)

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Team SHATTER Security Advisory SQL Injection in Oracle Application Server WWEXPAPIENGINE Audust 4, 2008 Risk Level: High Affected versions: Oracle Application Server 9.0.4.3, 10.1.2.2 and 10.1.4.1 Remote exploitable: Yes No authentication required...

Oracle SQL injection lateral attacks

SQL injection into uncontrolled PL/SQL procedires is possible with e.g. modification of data format with ALTER SESSION...

Sql injection

Unspecified vulnerability in the Oracle Portal component in Oracle Application Server 9.0.4.3, 10.1.2.2, and 10.1.4.1 has unknown impact and remote attack vectors. NOTE: the previous information was obtained from the Oracle July 2008 CPU. Oracle has not commented on reliable researcher claims tha...

Cross site scripting

Cross-site scripting XSS vulnerability in Calcium40.pl in Brown Bear Software Calcium 3.10 and 4.0.4 allows remote attackers to inject arbitrary web script or HTML via the CalendarName parameter in a ShowIt action...

CVE-2008-2507

Cross-site scripting XSS vulnerability in Calcium40.pl in Brown Bear Software Calcium 3.10 and 4.0.4 allows remote attackers to inject arbitrary web script or HTML via the CalendarName parameter in a ShowIt action...

CVE-2008-2507

Cross-site scripting XSS vulnerability in Calcium40.pl in Brown Bear Software Calcium 3.10 and 4.0.4 allows remote attackers to inject arbitrary web script or HTML via the CalendarName parameter in a ShowIt action...

CVE-2008-2507

CVE-2008-2507 concerns a cross-site scripting (XSS) vulnerability in Brown Bear Software Calcium 3.10 and 4.0.4 (Calcium40.pl). The issue arises in the ShowIt action where user-supplied input in the CalendarName parameter can be manipulated to inject arbitrary web script or HTML. The available do...

Unfixed XSS vulnerability at www.forex-forexforex1.pl

Security researcher FullFreeez, has submitted on 29/05/2008 a cross-site-scripting XSS vulnerability affecting www.forex-forexforex1.pl, which at the time of submission ranked 3700265 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 08/06/2008. ...

CVE-2008-2507: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Calcium40.pl in Brown Bear Software Calcium 3.10 and 4.0.4 allows remote attackers to inject arbitrary web script or HTML via the CalendarName parameter in a ShowIt action...

PostNuke Module PostSchedule (eid) SQL Injection Vulnerability

No description provided by source. Vuln: Postnuke Mod PostSchedule SQL Vuln Author: Vuln search Kacper kacper1964atyahoo.pl google:"PostSchedule ver 1" Vuln:...

Oracle Database 10G CTXSYS.DRVXTABX — PLSQL Injection

Application: Oracle Database 10G Versions Affected: Oracle 9.2.0.8, 9.2.0.8DV, 10.1.0.5, 10.2.0.4 Vendor URL: Bugs: PL/SQL Injections Exploits: YES Reported: 29.01.2008 Vendor response: 31.01.2008 CVE: CVE-2009-1991 SVSS2: 3.6 Date of Public Advisory: 26.10.2009 Solution: YES Non official Author:...