CVE-2008-0801: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in index.php in the PAXXGallery compaxxgallery 0.2 component for Mambo and Joomla! allow remote attackers to execute arbitrary SQL commands via 1 the iid parameter in a view action, and possibly 2 the userid parameter...

MeGaCheatZ 1.1 Multiple Remote SQL Injection Vulnerabilities

Exploit for unknown platform in category web applications ============================================================ MeGaCheatZ 1.1 Multiple Remote SQL Injection Vulnerabilities ============================================================...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in index.php in webSPELL 4.1.2 allow remote attackers to inject arbitrary web script or HTML via 1 the galleryID parameter in a usergallery upload action; or the 2 upID, 3 tag, 4 month, 5 userID, or 6 year parameter in a calendar announce action...

vanilla-sql.txt

= 4.1, magicquotesgpc=Off Tested on versions 1.1.3, 1.1.2, 1.0.1 echo "------------------------------------------------------------\n"; echo "Vanilla - use specific prefix default LUM\n"; echo "-id= - use specific user id default 1\n"; echo "-c= - benchmark's loop count default 300000\n"; echo "-...

Oracle audit issue with XMLDB ftp service

NGSSoftware Insight Security Research Advisory Name: Oracle audit issue with XMLDB ftp service Systems Affected: Oracle Oracle 9ir2, 10g Release 1 Severity: High Vendor URL: http://www.oracle.com/ Author: David Litchfield [email protected] Reported: 9th March 2006 Date of Public Advisory: 17...

Design/Logic Flaw

The XML DB XMLDB component in Oracle Database 9.2.0.8, 9.2.0.8DV, and 10.1.0.5 generates incorrect audit entries in the USERID column in which 1 long usernames are trimmed to 5 characters, or 2 short entries contain any extra characters from usernames in previous entries, aka DB23...

CVE-2007-5513: Undefined Security Weakness

The XML DB XMLDB component in Oracle Database 9.2.0.8, 9.2.0.8DV, and 10.1.0.5 generates incorrect audit entries in the USERID column in which 1 long usernames are trimmed to 5 characters, or 2 short entries contain any extra characters from usernames in previous entries, aka DB23...

Cross site scripting

Cross-site scripting XSS vulnerability in contactauthor.php AlstraSoft Article Manager Pro allows remote attackers to inject arbitrary web script or HTML via the userid parameter...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in AlstraSoft SMS Text Messaging Enterprise allow remote attackers to inject arbitrary web script or HTML via the 1 domain or 2 q parameter to a admin/membersearch.php, or 3 the userid parameter to b admin/edituser.php...

CVE-2007-4082

Cross-site scripting XSS vulnerability in contactauthor.php AlstraSoft Article Manager Pro allows remote attackers to inject arbitrary web script or HTML via the userid parameter...

CVE-2007-4082

Cross-site scripting XSS vulnerability in contactauthor.php AlstraSoft Article Manager Pro allows remote attackers to inject arbitrary web script or HTML via the userid parameter...

CVE-2007-4082: Undefined Security Weakness

Cross-site scripting XSS vulnerability in contactauthor.php AlstraSoft Article Manager Pro allows remote attackers to inject arbitrary web script or HTML via the userid parameter...

CVE-2007-4079: Undefined Security Weakness

Multiple cross-site scripting XSS vulnerabilities in AlstraSoft SMS Text Messaging Enterprise allow remote attackers to inject arbitrary web script or HTML via the 1 domain or 2 q parameter to a admin/membersearch.php, or 3 the userid parameter to b admin/edituser.php...

Sql injection

Multiple SQL injection vulnerabilities in changePW.php in AV Tutorial Script avtutorial 1.0, when magicquotesgpc is disabled, allow remote attackers to execute arbitrary SQL commands via the 1 id and 2 userid parameters, a different issue than CVE-2007-3630...

CVE-2007-3691: Undefined Security Weakness

Multiple SQL injection vulnerabilities in changePW.php in AV Tutorial Script avtutorial 1.0, when magicquotesgpc is disabled, allow remote attackers to execute arbitrary SQL commands via the 1 id and 2 userid parameters, a different issue than CVE-2007-3630...

Sql injection

SQL injection vulnerability in reply.php in VBZooM 1.12 allows remote attackers to execute arbitrary SQL commands via the UserID parameter to sub-join.php. NOTE: this may be the same as CVE-2006-3691.4...

CVE-2007-3588: Undefined Security Weakness

SQL injection vulnerability in reply.php in VBZooM 1.12 allows remote attackers to execute arbitrary SQL commands via the UserID parameter to sub-join.php. NOTE: this may be the same as CVE-2006-3691.4...

vbzoom-sql.txt

Discovered By: Hasadya Raed Contact : [email protected] Israel --------------------------- Script : VBZooM V1.12 VBZooM V1.12 "reply.php" SQL Injection Dork : POWERED BY VBZooM V1.12 --------------------------- B.File : reply.php --------------------------- Exploit :...

CVE-2007-1606: Undefined Security Weakness

Multiple cross-site scripting XSS vulnerabilities in w-Agora Web-Agora allow remote attackers to inject arbitrary web script or HTML via 1 the showuser parameter to profile.php, the 2 searchforum or 3 searchuser parameter to search.php, or 4 the userid parameter to changepassword.php...

IBM DB2 < 9 Fix Pack 2 Multiple Vulnerabilities

According to its version, the installation of IBM DB2 running on the remote host allows unsafe access to several setuid-root binaries. A local attacker can exploit this to crash the affected database server or possibly even gain root-level access. In addition, the fenced userid may be able to...