Sql injection

SQL injection vulnerability in the Schema API in Drupal 6.x before 6.3 allows remote attackers to execute arbitrary SQL commands via vectors related to "an inappropriate placeholder for 'numeric' fields."...

CVE-2008-3223

SQL injection vulnerability in the Schema API in Drupal 6.x before 6.3 allows remote attackers to execute arbitrary SQL commands via vectors related to "an inappropriate placeholder for 'numeric' fields."...

CVE-2008-3223

SQL injection vulnerability in the Schema API in Drupal 6.x before 6.3 allows remote attackers to execute arbitrary SQL commands via vectors related to "an inappropriate placeholder for 'numeric' fields."...

CVE-2008-3223

SQL injection vulnerability in the Schema API in Drupal 6.x before 6.3 allows remote attackers to execute arbitrary SQL commands via vectors related to "an inappropriate placeholder for 'numeric' fields."...

Drupal多个输入验证漏洞

BUGTRAQ ID: 30168 Drupal是一款开放源码的内容管理平台。 Drupal中存在多个输入验证错误，可能允许恶意用户执行跨站脚本、跨站请求伪造、会话固定、SQL注入和脚本注入攻击。 1 Drupal没有正确地过滤传送给分类词汇的某些输入，这可能导致注入任意HTML和脚本代码并在用户浏览器会话中执行。 2 Drupal没有正确地过滤OpenID provider所提供的某些输入便返回给了用户，这可能导致注入任意HTML和脚本代码并在用户浏览器会话中执行。 3 用户可以通过HTTP请求执行某些操作，如果登录用户受骗访问了恶意站点的话就会导致删除OpenID或转换字符串。 4...

Single MySQL worker can be crashed (NULL deref) with certain SELECT statements

MySQL 5.x before 5.0.36 allows local users to cause a denial of service database crash by performing informationschema table subselects and using ORDER BY to sort a single-row result, which prevents certain structure elements from being initialized and triggers a NULL dereference in the filesort...

MX-System 2.7.3 - index.php SQL Injection

MX-System 2.7.3 - index.php SQL Injection Name : MX-System 2.7.3 index.php page Remote SQL Injection Vulnerability Author : cOndemned Dork : intext:Powered by MX-System 2.7.3 Greetz : ZaBeaTy, str0ke, doctor, Avantura /3 PoC :...

Design/Logic Flaw

Unspecified vulnerability in the Oracle Ultra Search component in Oracle Collaboration Suite 10.1.2; Database 9.2.0.8, 10.1.0.5, and 10.2.0.3; and Application Server 9.0.4.3 and 10.1.2.0.2; has unknown impact and local attack vectors, aka OCS01. NOTE: Oracle has not disputed a reliable claim that...

CVE-2008-0347

Unspecified vulnerability in the Oracle Ultra Search component in Oracle Collaboration Suite 10.1.2; Database 9.2.0.8, 10.1.0.5, and 10.2.0.3; and Application Server 9.0.4.3 and 10.1.2.0.2; has unknown impact and local attack vectors, aka OCS01. NOTE: Oracle has not disputed a reliable claim that...

CVE-2008-0347

CVE-2008-0347 concerns an unspecified vulnerability in the Oracle Ultra Search component of Oracle Collaboration Suite 10.1.2, and in related Database 9.2.0.8, 10.1.0.5, 10.2.0.3, and Application Server 9.0.4.3 and 10.1.2.0.2. The issue is described as having unknown impact and local attack vecto...

MySQL 5.1.13 - INFORMATION_SCHEMA Remote Denial of Service

source: https://www.securityfocus.com/bid/28351/info MySQL is prone to a remote denial-of-service vulnerability because it fails to handle certain specially crafted queries. An attacker can exploit this issue to crash the application, denying access to legitimate users. NOTE: An attacker must be...

Ubuntu 6.06 LTS / 6.10 / 7.04 : postgresql-8.1, postgresql-8.2 vulnerability (USN-454-1)

PostgreSQL did not handle the 'searchpath' configuration option in a secure way for functions declared as 'SECURITY DEFINER'. Previously, an attacker could override functions and operators used by the security definer function to execute arbitrary SQL commands with the privileges of the user who...

SimpCMS - 'keyword' SQL Injection

SimpCMS = all Remote SQL Injection Vulnerability Found By : ú Cold z3ro , http://www.hackteach.org/ Script : http://www.simpcms.com/ ==================================== Exploit : /index.php?site=search&keyword=1'//union//select//0,1,2,3,name,5,6//from//categories/ OR /index.php?site=search in...

CVE-2006-7217

Apache Derby before 10.2.1.6 does not determine schema privilege requirements during the DropSchemaNode bind phase, which allows remote authenticated users to execute arbitrary drop schema statements in SQL authorization mode...

CVE-2006-7217

Apache Derby before 10.2.1.6 does not determine schema privilege requirements during the DropSchemaNode bind phase, which allows remote authenticated users to execute arbitrary drop schema statements in SQL authorization mode...

CVE-2006-7217

CVE-2006-7217 affects Apache Derby prior to 10.2.1.6. The vulnerability arises because the DropSchemaNode bind phase does not correctly enforce schema privilege requirements, allowing remote authenticated users to execute arbitrary DROP SCHEMA statements when SQL authorization mode is in effect. ...

MySQL 5.0.x - Single Row SubSelect Remote Denial of Service

MySQL 5.0.x - Single Row SubSelect Remote Denial of Service source: https://www.securityfocus.com/bid/22900/info MySQL is prone to a remote denial-of-service vulnerability because it fails to handle certain select statements to database metadata. An attacker can exploit this issue to crash the...

SEC Consult SA-20070309-0 :: MySQL 5 Single Row Subselect Denial of Service

SEC-CONSULT Security Advisory 20070309-0 =========================================================================== title: MySQL 5 Single Row Subselect Denial of Service program: MySQL 5 vulnerable version: 5.0.37 impact: moderate homepage: http://www.mysql.com found: 2007-02-10 by: S.Streichbie...

Shopstorenow E-Commerce Shopping Cart - Orange.asp SQL Injection

Shopstorenow E-Commerce Shopping Cart - Orange.asp SQL Injection source: https://www.securityfocus.com/bid/21905/info Shopstorenow E-commerce Shopping Cart is prone to an SQL-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in an SQL...

CVE-2006-3610

index.php in Orbitcoders OrbitMATRIX 1.0 allows remote attackers to obtain sensitive information partial database schema via a modified pagename parameter, which reflects portions of an SQL query in the result. NOTE: it is not clear whether the information is target-specific. If not, then this...