CVE-2007-0630

CVE-2007-0630 describes multiple SQL injection vulnerabilities in the generate_csv function of X-dev xNews 1.3 and earlier. The affected component is generate_csv in classes/class.news.php, with vulnerable parameters (id, from, q). The issue enables remote attackers to execute arbitrary SQL comma...

Remote file inclusion

PHP remote file inclusion vulnerability in includes/functions.visohotlink.php in VisoHotlink 1.01 and possibly earlier allows remote attackers to execute arbitrary PHP code via a URL in the mosConfigabsolutepath parameter...

Multiple Remote Vulnerabilities in Wordpress

Advisory: Multiple Remote Vulnerabilities in Wordpress Advisory ID: 4tphi-sa-20070111-wordpress Release Date: 01-24-2007 Author: Blake Matheny [email protected] Software: WordPress 2.1 Impact: Remote & Local DoS, File Disclosure Overview: From Wikipedia, "WordPress is a blog publishing syste...

CVE-2007-0304

SQL injection vulnerability in duyuru.asp in MiNT Haber Sistemi 2.7 allows remote attackers to execute arbitrary SQL commands via the id parameter...

BEA产品多个远程安全漏洞

BEA Systems WebLogic包含多种应用系统集成方案，包括Server/Express/Integration等。 BEA Weblogic中存在多个安全漏洞，可能允许恶意攻击者获得敏感信息、绕过某些安全限制、导致拒绝服务或完全入侵系统。 这些漏洞包括： 1 SSL库中的漏洞可能允许判断明文块； 2 从缓存重用连接时服务器没有正确地验证客户端证书，导致攻击者可以通过X.509证书访问Web服务器。成功攻击要求应用程序允许通过单个客户端进程访问多个用户； 3 存储在JDBCDataSourceFactory MBean Properties属性中的口令没有加密； 4...

CVE-2007-0263

Unspecified vulnerability in Total Commander before 6.5.6 allows user-assisted remote attackers to delete arbitrary files and corrupt a filesystem via a crafted RAR file. NOTE: The provenance of this information is unknown; the details are obtained solely from third party information...

Memory corruption

Microsoft Excel 2000 SP3, 2002 SP3, 2003 SP2, 2004 for Mac, and v.X for Mac allows remote attackers to execute arbitrary code via malformed IMDATA records that trigger memory corruption...

CVE-2007-0092

SQL injection vulnerability in productdetail.asp in E-SMARTCART 1.0 allows remote attackers to execute arbitrary SQL commands via the productid parameter...

CVE-2006-4575

Multiple SQL injection vulnerabilities in The Address Book 1.04e allow remote attackers to execute arbitrary SQL commands via the 1 lastname, 2 firstname, 3 passwordOld, 4 passwordNew, 5 id, 6 language, 7 defaultLetter, 8 newuserPass, 9 newuserType, 10 newuserEmail parameters in a user.php; the 1...

ANDR : Buffer overflow attacks

Buffer overflow attacks Andrey Kolischak November, 1999 Buffer overflow attacks Buffer overflows is the name of the most common software security vulnerability. The first attack using this vulnerability was used in the Morris worm in 1988. Since then, their number has increased every year...

CVE-2006-6910

formbankcgi.exe in Fersch Formbankserver 1.9, when the PATHINFO begins with Abfrage, allows remote attackers to cause a denial of service daemon crash via multiple requests containing many /../ sequences in the Name parameter...

CVE-2006-6862

Multiple cross-site scripting XSS vulnerabilities in Outfront Spooky Login 2.7 allow remote attackers to inject arbitrary web script or HTML via unspecified parameters to 1 login/login.asp or 2 login/register.asp...

CVE-2006-6803

SQL injection vulnerability in Types.asp in Enthrallweb eCars 1.0 allows remote attackers to execute arbitrary SQL commands via the Typeid parameter...

EUVD-2006-6768

The 1 settings.php and 2 subscribers.php scripts in Open Newsletter 2.5 and earlier do not exit when authentication fails, which allows remote attackers to perform unauthorized administrative actions, or execute arbitrary code in conjunction with another vulnerability...

CVE-2006-6717

The CVE-2006-6717 entry affects the Allied Telesis AT-9000/24 Ethernet switch. The vulnerability arises because the device accepts management packets from arbitrary VLANs, contrary to documentation, enabling remote attackers to reach the switch from unexpected locations. The impact is described i...

CVE-2006-6717

The Allied Telesis AT-9000/24 Ethernet switch accepts management packets from arbitrary VLANs, contrary to the documentation, which allows remote attackers to conduct attacks against the switch from unexpected locations...

CVE-2006-6384

Absolute path traversal vulnerability in abitwhizzy.php before 20061204 allows remote attackers to read arbitrary files via an absolute pathname in the Filename text window f parameter, a variant of CVE-2006-6084...

CVE-2006-6249

Cross-site scripting XSS vulnerability in Chama Cargo 4.36 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2006-5917

Multiple SQL injection vulnerabilities in OmniStar Article Manager allow remote attackers to execute arbitrary SQL commands via the 1 articleid parameter in a articles/comments.php and b articles/article.php, and the 2 pageid parameter in c articles/pages.php...

Update Protection against Multiple MySQL Query Commands Vulnerabilities

MySQL is an open-source relational database management system that is rapidly growing in popularity. MySQL is free for most applications and is heavily used by the open source community, running on both Windows and UNIX operating systems. SQL query commands form a logical unit and perform a...