Microsoft SQL Server fails to properly validate parameters to the sp_replwritetovarbin extended stored procedure

Overview A vulnerability in the Microsoft SQL Server spreplwritetovarbin extended stored procedure could allow an authenticated attacker to execute arbitrary code on an affected server. Description Some versions of Microsoft SQL Server contain a vulnerability in the spreplwritetovarbin stored...

CVE-2008-5102: Undefined Security Weakness

PythonScripts in Zope 2 2.11.2 and earlier, as used in Conga and other products, allows remote authenticated users to cause a denial of service resource consumption or application halt via certain 1 raise or 2 import statements...

Joekoe(乔客CMS)3.0Sql注入漏洞

JoekoeCMS3在获取客户端浏览器类型参数User-agent时没有严格过滤，导致在引入查询时可以通过修改数据包构造特殊的user-agent值来达到添加后台管理员等目的。 JoekoeCMS3将所有类都封装在了一个JoekoeCMS3b.dll的Dll中， Joekoe是通过cls.ipsys1来获取客户端的User-Agent，所以在其程序中调用cls.ipsys1并放入SQL查询的页面\common\review.asp、\forum\post.asp、\forum\inc\incpost.asp均存在此漏洞。...

Design/Logic Flaw

MySQL 5.0 before 5.0.66, 5.1 before 5.1.26, and 6.0 before 6.0.6 does not properly handle a b'' b single-quote single-quote token, aka an empty bit-string literal, which allows remote attackers to cause a denial of service daemon crash by using this token in a SQL statement...

MySQL 6.0 < 6.0.6 Empty Bit-String Literal Token SQL Statement DoS

The version of MySQL 6.0 installed on the remote host is earlier than 6.0.6. A bug in such versions can lead to a server crash in 'Itembinstring::Itembinstring' when handling an empty bit-string literal b''. Using a simple SELECT statement, an authenticated remote user can leverage this issue to...

Debian Security Advisory DSA 1608-1 (mysql-dfsg-5.0)

The remote host is missing an update to mysql-dfsg-5.0 announced via advisory DSA 1608-1. OpenVAS Vulnerability Test $Id: deb16081.nasl 6616 2017-07-07 12:10:49Z cfischer $ Description: Auto-generated from advisory DSA 1608-1 mysql-dfsg-5.0 Authors: Thomas Reinke Copyright: Copyright c 2008 E-Sof...

Buffer overflow

Buffer overflow in Microsoft SQL Server 2005 SP1 and SP2, and 2005 Express Edition SP1 and SP2, allows remote authenticated users to execute arbitrary code via a crafted insert statement...

CVE-2008-0106: Improper Restriction of Operations within the Bounds of a Memory Buffer

Buffer overflow in Microsoft SQL Server 2005 SP1 and SP2, and 2005 Express Edition SP1 and SP2, allows remote authenticated users to execute arbitrary code via a crafted insert statement...

Microsoft Internet Explorer 6 contains a cross-domain vulnerability

Overview Microsoft Internet Explorer 6 is vulnerable to a cross-domain scripting violation, which can allow a remote, unauthenticated attacker to access the content of a web page in a different domain. Description IE uses a cross-domain security model to maintain separation between browser frames...

Vim多个Shell命令注入漏洞

BUGTRAQ ID: 29715 VIM是一款免费开放源代码文本编辑器，可使用在Unix/Linux操作系统下。 VIM的filetype.vim、tar.vim、zip.vim、xpm.vim、xpm2.vim、gzip.vim和netrw.vim脚本没有正确地转义传送给execute语句的文件名中的特殊字符，如果用户受骗打开了恶意文件的话，就可能导致向受影响系统注入并执行任意SHELL命令。 VIM Development Group VIM 7.1.314 VIM Development Group VIM 6.4 VIM Development Group...

Code injection

Multiple off-by-one errors in opensuse-updater in openSUSE 10.2 have unspecified impact and attack vectors. NOTE: the vendor states that these "can be considered no security problem."...

Web Group Communication Center (WGCC) &lt;= 1.0.3 SQL Injection Vuln

No description provided by source. Title : Web Group Communication Center XSS/SQL Multiple Remote Vulnerabilies Author : myvx Date : 13.05.2008 Application : Web Group Communication Center Version : = 1.0.3 PreRelease 1 Vendor : http://wgcc.de/ Download :...

CVE-2008-1926

Argument injection vulnerability in login login-utils/login.c in util-linux-ng 2.14 and earlier makes it easier for remote attackers to hide activities by modifying portions of log events, as demonstrated by appending an "addr=" statement to the login name, aka "audit log injection."...

Crack mysql root password in several ways-vulnerability warning-the black bar safety net

Online streaming of several crack mysql root password in several ways: Method one Using phpmyadmin, this is the easiest, and modify the mysql database user table, but don't forget to use the PASSWORD function. Method two Using mysqladmin, which was previously statement of a special case...

Microsoft Office Web Components Spreadsheet ActiveX control URL parsing stack buffer overflow

Overview The Microsoft Office Web Components ActiveX controls contain a stack buffer overflow in the processing of URLs, which allows a remote, unauthenticated attacker to execute arbitrary code on a vulnerable system. Description Microsoft Office Web Components are ActiveX controls that provide...

Koobi Pro 5.7 (categ) Remote SQL Injection Vulnerability

Exploit for unknown platform in category web applications ======================================================== Koobi Pro 5.7 categ Remote SQL Injection Vulnerability ======================================================== + Koobi Pro 5.7 index.php categ Remote Sql Inj. Vuln +...

CVE-2008-0696

IBM DB2 UDB before 8.2 Fixpak 16 does not properly check authorization for the ALTER TABLE statement, which has unknown impact and attack vectors...

Adobe Reader and Acrobat JavaScript methods buffer overflow vulnerabilities

Overview Adobe Reader and Acrobat contains multiple buffer overflow vulnerabilities. Successful exploitation of this vulnerability may allow an attacker to execute code. Description Adobe Acrobat Reader is software designed to view Portable Document Format PDF files. Adobe also distributes the...

Memory corruption

The JavaScript engine in Mozilla Firefox before 2.0.0.12, Thunderbird before 2.0.0.12, and SeaMonkey before 1.1.8 allows remote attackers to cause a denial of service crash and possibly trigger memory corruption via 1 a large switch statement, 2 certain uses of watch and eval, 3 certain uses of t...

CVE-2008-0413

The JavaScript engine in Mozilla Firefox before 2.0.0.12, Thunderbird before 2.0.0.12, and SeaMonkey before 1.1.8 allows remote attackers to cause a denial of service crash and possibly trigger memory corruption via 1 a large switch statement, 2 certain uses of watch and eval, 3 certain uses of t...