TelebidAuctionScript - 'aid' Blind SQL Injection

TelebidauctionScriptaid Blind SQL Injection Vulnerability Author : Hussin X Home : www.IQ-TY.com email : [email protected] Vendor : http://www.telebidauctionscript.com/ Demo : http://server/allauctions.php?aid=2+and+1=1 true http://server/allauctions.php?aid=2+and+1=0 false :: Table ::...

Important: Red Hat Security Advisory: java-1.6.0-openjdk security update

Updated java-1.6.0-openjdk packages that fix several security issues are now available for Red Hat Enterprise Linux 5. This update has been rated as having important security impact by the Red Hat Security Response Team. These packages provide the OpenJDK 6 Java Runtime Environment and the OpenJD...

Ubuntu 8.10 / 9.04 / 9.10 : openjdk-6 vulnerabilities (USN-859-1)

Dan Kaminsky discovered that SSL certificates signed with MD2 could be spoofed given enough time. As a result, an attacker could potentially create a malicious trusted certificate to impersonate another site. This update handles this issue by completely disabling MD2 for certificate validation in...

USN-859-1: OpenJDK vulnerabilities

Dan Kaminsky discovered that SSL certificates signed with MD2 could be spoofed given enough time. As a result, an attacker could potentially create a malicious trusted certificate to impersonate another site. This update handles this issue by completely disabling MD2 for certificate validation in...

OpenJDK zoneinfo file existence information leak (6824265)

The TimeZone.getTimeZone method in Sun Java SE 5.0 before Update 22 and 6 before Update 17, and OpenJDK, allows remote attackers to determine the existence of local files via vectors related to handling of zoneinfo aka tz files, aka Bug Id 6824265...

OpenJDK zoneinfo file existence information leak (6824265)

The TimeZone.getTimeZone method in Sun Java SE 5.0 before Update 22 and 6 before Update 17, and OpenJDK, allows remote attackers to determine the existence of local files via vectors related to handling of zoneinfo aka tz files, aka Bug Id 6824265...

Microsoft Windows索引服务ActiveX控件内存破坏漏洞（MS09-057）

BUGTRAQ ID: 36629 CVECAN ID: CVE-2009-2507 Windows是微软发布的非常流行的操作系统。 Windows的索引服务所包含的ActiveX控件未正确处理特制Web内容，导致Windows系统上的索引服务中存在内存破坏漏洞。成功利用此漏洞的攻击者可以完全控制受影响的系统。 Microsoft Windows XP SP3 Microsoft Windows XP SP2 Microsoft Windows Server 2003 SP2 Microsoft Windows Server 2003 SP1 Microsoft Windows...

Microsoft Windows Shell Remote Code Execution (MS04-024; CVE-2004-0420)

A vulnerability has been discovered in the Microsoft Windows Shell, an API that provides a basic framework for the Windows user interface. The Shell provides many functions that perform various configuration tasks and background operations, such as launching applications through the Start Menu...

Sql injection

SQL injection vulnerability in viewnews.php in Vastal I-Tech MMORPG Zone allows remote attackers to execute arbitrary SQL commands via the newsid parameter. NOTE: the gameid vector is already covered by CVE-2008-4460...

Sql injection

SQL injection vulnerability in viewmag.php in Vastal I-Tech DVD Zone allows remote attackers to execute arbitrary SQL commands via the magid parameter, a different vector than CVE-2008-4465...

Cross site scripting

Cross-site scripting XSS vulnerability in viewmag.php in Vastal I-Tech DVD Zone allows remote attackers to inject arbitrary web script or HTML via the magid parameter...

CVE-2009-3495

SQL injection vulnerability in viewmag.php in Vastal I-Tech DVD Zone allows remote attackers to execute arbitrary SQL commands via the magid parameter, a different vector than CVE-2008-4465...

CVE-2009-3505

SQL injection vulnerability in viewnews.php in Vastal I-Tech MMORPG Zone allows remote attackers to execute arbitrary SQL commands via the newsid parameter. NOTE: the gameid vector is already covered by CVE-2008-4460...

Sql injection

SQL injection vulnerability in viewlisting.php in Vastal I-Tech Agent Zone aka The Real Estate Script allows remote attackers to execute arbitrary SQL commands via the id parameter...

CVE-2009-3495

SQL injection vulnerability in viewmag.php in Vastal I-Tech DVD Zone allows remote attackers to execute arbitrary SQL commands via the magid parameter, a different vector than CVE-2008-4465...

CVE-2009-3496

Cross-site scripting XSS vulnerability in viewmag.php in Vastal I-Tech DVD Zone allows remote attackers to inject arbitrary web script or HTML via the magid parameter...

CVE-2009-3505

The CVE-2009-3505 entry documents a SQL injection vulnerability in view_news.php of the Vastal I-Tech MMORPG Zone, exploitable via the news_id parameter. The underlying issue is improper handling of user-supplied input in a SQL query, enabling remote attackers to execute arbitrary SQL commands. T...

CVE-2009-3495

CVE-2009-3495 describes an SQL injection in view_mag.php of Vastal I-Tech DVD Zone, exploitable via the mag_id parameter to execute arbitrary SQL commands. This mirrors the vulnerability family seen in CVE-2008-4465 but with a different input vector. The description across sources confirms a remo...

CVE-2009-3496

CVE-2009-3496 describes a cross-site scripting (XSS) vulnerability in the Vastal I-Tech DVD Zone’s view_mag.php, exploitable via the mag_id parameter to inject arbitrary script/HTML. Affected component is the server-side script handling mag_id in that application. The connected documents corrobor...

CVE-2009-3505

SQL injection vulnerability in viewnews.php in Vastal I-Tech MMORPG Zone allows remote attackers to execute arbitrary SQL commands via the newsid parameter. NOTE: the gameid vector is already covered by CVE-2008-4460...