ATutor Password Reminder SQL Injection

The remote host is running ATutor, an open source, web-based, Learning Content Management System LCMS designed with accessibility and adaptability in mind. The remote version of this software contains an input validation flaw in the 'passwordreminder.php' script. This vulnerability occurs only wh...

DeluxeBB Multiple Scripts SQL Injection

The remote host is using DeluxeBB, a web application forum written in PHP. The installed version of this software fails to sanitize input to several parameters and scripts before using it to generate SQL queries. Provided PHP's 'magicquotesgpc' setting is disabled, an attacker may be able to...

Stylemotion WEB//NEWS 1.4 - 'startup.php' Cookie SQL Injection

source: https://www.securityfocus.com/bid/14776/info WEB//NEWS is prone to multiple SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in SQL queries. Successful exploitation could result in a compromise of...

Stylemotion WEB//NEWS 1.4 - 'print.php?id' SQL Injection

source: https://www.securityfocus.com/bid/14776/info WEB//NEWS is prone to multiple SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in SQL queries. Successful exploitation could result in a compromise of...

phpAdsNew / phpPgAds < 2.0.6 Multiple Vulnerabilities

The remote host is running phpAdsNew / phpPgAds, an open source banner ad server. The version of phpAdsNews / phpPgAds installed on the remote host suffers from several flaws : - Remote PHP Code Injection Vulnerability The XML-RPC library bundled with the application allows an attacker to inject...

PHPMyFAQ 1.5.1 - Password.php SQL Injection

PHPMyFAQ 1.5.1 - Password.php SQL Injection source: https://www.securityfocus.com/bid/14927/info phpMyFAQ is affected by an SQL injection vulnerability. This issue is due to the application failing to properly sanitize user-supplied input before using it in a SQL query. This vulnerability could...

PHPMyFAQ 1.5.1 - 'Password.php' SQL Injection

source: https://www.securityfocus.com/bid/14927/info phpMyFAQ is affected by an SQL injection vulnerability. This issue is due to the application failing to properly sanitize user-supplied input before using it in a SQL query. This vulnerability could permit remote attackers to pass malicious inp...

RunCMS 1.1/1.2 Module Newbb_plus/Messages - SQL Injection

source: https://www.securityfocus.com/bid/14631/info RunCMS is prone to multiple SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in SQL queries. Successful exploitation could result in a compromise of the...

CVE-2004-2399

Secure Computing Corporation Sidewinder G2 6.1.0.01 allows remote attackers to cause a denial of service CPU consumption via delayed responses to DNS queries...

CVE-2004-2349

Multiple SQL injection vulnerabilities in Tunez before 1.20-pre2 allow remote attackers to execute arbitrary SQL queries...

FreznoShopSQL.txt

FreznoShop Vulnerability Details Date: May 13, 2005 Mike Shema Versions of FreznoShop http://www.freznoshop.de/ below 1.4.1 are vulnerable to SQL injection due to the use of unvalidated parameters in database queries. Some unpatched versions of 1.4.1 are vulnerable as well. The value of the 'id'...

PortailPHP 2.4 - 'index.php' SQL Injection

source: https://www.securityfocus.com/bid/14474/info Portail PHP is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in SQL queries. The consequences of this attack may vary depending on the type of...

Debian DSA-771-1 : pdns - several vulnerabilities

Several problems have been discovered in pdns, a versatile nameserver that can lead to a denial of service. The Common Vulnerabilities and Exposures project identifies the following problems : - CAN-2005-2301 Norbert Sendetzky and Jan de Groot discovered that the LDAP backend did not properly...

FreeBSD : PowerDNS -- LDAP backend fails to escape all queries (43a7b0a7-f9bc-11d9-b473-00061bc2ad93)

The LDAP backend in PowerDNS has issues with escaping queries which could cause connection errors. This would make it possible for a malicious user to temporarily blank domains. This is known to affect all releases prior to 2.9.18. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The...

PHP-Fusion <= 6.00.106 Multiple Vulnerabilities

According to its banner, the remote host is running a version of PHP-Fusion that suffers from multiple vulnerabilities : - SQL Injection Vulnerability The application fails to sanitize user-supplied input to the 'msgview' parameter of the 'messages.php' script before using it in database queries...

Hosting Controller <= 6.1 Hotfix 2.2 Multiple Vulnerabilities

According to its version number, the installation of Hosting Controller on the remote host improperly allows an authenticated user to add hosting plans to his account, to edit the details of his own or anyone else's hosting plans, to view the folders of all resellers and the web admin, to add...

PHP-Fusion < 6.00.107 Multiple Vulnerabilities

Binary data 3100.prm...

PHPNews 1.2.x - 'auth.php' SQL Injection

source: https://www.securityfocus.com/bid/14333/info PHPNews is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in SQL queries. This vulnerability could permit remote attackers to pass malicious...

CVE-2005-2301

PowerDNS before 2.9.18, when running with an LDAP backend, does not properly escape LDAP queries, which allows remote attackers to cause a denial of service failure to answer ldap questions and possibly conduct an LDAP injection attack...

PowerDNS -- LDAP backend fails to escape all queries

The LDAP backend in PowerDNS has issues with escaping queries which could cause connection errors. This would make it possible for a malicious user to temporarily blank domains. This is known to affect all releases prior to 2.9.18...