jetlib.sec » Tags » backend-database

Feeds

133340 items (0 unread) in 27 feeds

• 1337day (was: Inj3ct0r, 1337db)
• OSVDB Vulnerabilities
• Exploit-DB
• SecurityFocus Vulnerabilities
• Bugtraq
• Full Disclosure
• XSSed
• Packet Storm Security Headlines
• Packet Storm Security Advisories
• Packet Storm Security Exploits
• Packet Storm Security Recent Files
• Packet Storm Security Tools
• Packet Storm Security Misc. Files
• Sophos security news
• Sophos product advisories
• Penetration Testing
• SecuriTeam
• BackTrack Linux Forums
• Threatpost
• SecDocs
• carnal0wnage.attackresearch.com
• Carnal0wnage
• Kernel Fun
• Darknet
• The Exploitant
• Hack a Day
• Wirevolution

16 items tagged "backend database"

Related tags: vulnerability [+], zero [+], tcp port 443 [+], exploitation techniques [+], day [+], returns management [+], micro control [+], manager. user [+], management interface [+], management [+], login [+], knowledgetree [+], initiative [+], host os [+], epicor [+], tcp port 80 [+], safer use [+], manager. authentication [+], manager interface [+], backend [+], symantec [+], sql injection [+], manager rdserver [+], cisco unified [+], callmanager [+], attackers [+], sql [+]

• May 18, 2012
• 7:25

  Epicor Returns Management SOAP-Based Blind SQL Injection

   » ‎ Packet Storm Security Advisories
  Digital Defense, Inc. (DDI) has discovered a blind SQL injection vulnerability in the Epicor Returns Management software SOAP interface. Left unremediated, this vulnerability could be leveraged by an attacker to execute arbitrary SQL commands and extract information from the backend database using standard SQL exploitation techniques. Additionally, an attacker may be able to leverage this flaw to compromise the database server host operating system.

  Tags:  epicor management sql exploitation-techniques returns-management backend-database  

• 7:25

  Epicor Returns Management SOAP-Based Blind SQL Injection

   » ‎ Packet Storm Security Recent Files
  Digital Defense, Inc. (DDI) has discovered a blind SQL injection vulnerability in the Epicor Returns Management software SOAP interface. Left unremediated, this vulnerability could be leveraged by an attacker to execute arbitrary SQL commands and extract information from the backend database using standard SQL exploitation techniques. Additionally, an attacker may be able to leverage this flaw to compromise the database server host operating system.

  Tags:  epicor management sql exploitation-techniques returns-management backend-database  

• 7:25

  Epicor Returns Management SOAP-Based Blind SQL Injection

   » ‎ Packet Storm Security Misc. Files
  Digital Defense, Inc. (DDI) has discovered a blind SQL injection vulnerability in the Epicor Returns Management software SOAP interface. Left unremediated, this vulnerability could be leveraged by an attacker to execute arbitrary SQL commands and extract information from the backend database using standard SQL exploitation techniques. Additionally, an attacker may be able to leverage this flaw to compromise the database server host operating system.

  Tags:  epicor management sql exploitation-techniques returns-management backend-database  

• December 07, 2011
• 20:02

  KnowledgeTree login.php Blind SQL Injection

   » ‎ Packet Storm Security Advisories
  The KnowledgeTree login.php login page is vulnerable to a blind SQL injection vulnerability within the username field. An attacker can leverage this flaw to execute arbitrary SQL commands and extract sensitive information from the backend database using standard blind SQL exploitation techniques. Additionally, an attacker may be able to leverage this flaw to compromise the database server host OS.

  Tags:  knowledgetree login sql exploitation-techniques host-os backend-database  

• 20:02

  KnowledgeTree login.php Blind SQL Injection

   » ‎ Packet Storm Security Recent Files
  The KnowledgeTree login.php login page is vulnerable to a blind SQL injection vulnerability within the username field. An attacker can leverage this flaw to execute arbitrary SQL commands and extract sensitive information from the backend database using standard blind SQL exploitation techniques. Additionally, an attacker may be able to leverage this flaw to compromise the database server host OS.

  Tags:  knowledgetree login sql exploitation-techniques host-os backend-database  

• 20:02

  KnowledgeTree login.php Blind SQL Injection

   » ‎ Packet Storm Security Misc. Files
  The KnowledgeTree login.php login page is vulnerable to a blind SQL injection vulnerability within the username field. An attacker can leverage this flaw to execute arbitrary SQL commands and extract sensitive information from the backend database using standard blind SQL exploitation techniques. Additionally, an attacker may be able to leverage this flaw to compromise the database server host OS.

  Tags:  knowledgetree login sql exploitation-techniques host-os backend-database  

• July 26, 2011
• 19:14

  Cisco Unified CallManager xmldirectorylist.jsp SQL Injection Vulnerability

   » ‎ SecuriTeam
  This vulnerability allows remote attackers to inject arbitrary SQL into the backend database on vulnerable installations of Cisco Unified CM.

  -

  Make your website safer. Use external penetration testing service. First report ready in one hour!

  Tags:  vulnerability sql callmanager cisco-unified sql-injection safer-use backend-database  

• July 11, 2011
• 12:30

  Zero Day Initiative Advisory 11-234

   » ‎ Packet Storm Security Advisories
  Zero Day Initiative Advisory 11-234 - This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Trend Micro Control Manager. User interaction is required to exploit this vulnerability in that the target must visit a malicious page. The specific flaw exists within the Cas_LogDirectInsert.aspx http handler, which listens by default on TCP port 443. A specially crafted POST request allows remote attackers to supply XML and schema information which is used within queries to the backend database. By supplying malicious values, an attacker can inject themselves a user account which can be used to execute code via the management console on the service.

  Tags:  day zero initiative manager.-user tcp-port-443 micro-control backend-database  

• 12:30

  Zero Day Initiative Advisory 11-234

   » ‎ Packet Storm Security Recent Files
  Zero Day Initiative Advisory 11-234 - This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Trend Micro Control Manager. User interaction is required to exploit this vulnerability in that the target must visit a malicious page. The specific flaw exists within the Cas_LogDirectInsert.aspx http handler, which listens by default on TCP port 443. A specially crafted POST request allows remote attackers to supply XML and schema information which is used within queries to the backend database. By supplying malicious values, an attacker can inject themselves a user account which can be used to execute code via the management console on the service.

  Tags:  day zero initiative manager.-user tcp-port-443 micro-control backend-database  

• 12:30

  Zero Day Initiative Advisory 11-234

   » ‎ Packet Storm Security Misc. Files
  Zero Day Initiative Advisory 11-234 - This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Trend Micro Control Manager. User interaction is required to exploit this vulnerability in that the target must visit a malicious page. The specific flaw exists within the Cas_LogDirectInsert.aspx http handler, which listens by default on TCP port 443. A specially crafted POST request allows remote attackers to supply XML and schema information which is used within queries to the backend database. By supplying malicious values, an attacker can inject themselves a user account which can be used to execute code via the management console on the service.

  Tags:  day zero initiative manager.-user tcp-port-443 micro-control backend-database  

• January 12, 2011
• 19:33

  Zero Day Initiative Advisory 11-013

   » ‎ Packet Storm Security Advisories
  Zero Day Initiative Advisory 11-013 - This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Symantec Web Gateway. Authentication is not required to exploit this vulnerability. The specific flaw exists within the management interface which listens by default on TCP port 443. While parsing requests sent to the login.php page, the process does not properly sanitize the USERNAME POST parameter. By sending a specially crafted string, a remote attacker can leverage this vulnerability to inject arbitrary SQL into the backend database on the server.

  Tags:  day zero vulnerability tcp-port-443 management-interface backend-database  

• 19:33

  Zero Day Initiative Advisory 11-013

   » ‎ Packet Storm Security Recent Files
  Zero Day Initiative Advisory 11-013 - This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Symantec Web Gateway. Authentication is not required to exploit this vulnerability. The specific flaw exists within the management interface which listens by default on TCP port 443. While parsing requests sent to the login.php page, the process does not properly sanitize the USERNAME POST parameter. By sending a specially crafted string, a remote attacker can leverage this vulnerability to inject arbitrary SQL into the backend database on the server.

  Tags:  day zero vulnerability tcp-port-443 management-interface backend-database  

• 19:33

  Zero Day Initiative Advisory 11-013

   » ‎ Packet Storm Security Misc. Files
  Zero Day Initiative Advisory 11-013 - This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Symantec Web Gateway. Authentication is not required to exploit this vulnerability. The specific flaw exists within the management interface which listens by default on TCP port 443. While parsing requests sent to the login.php page, the process does not properly sanitize the USERNAME POST parameter. By sending a specially crafted string, a remote attacker can leverage this vulnerability to inject arbitrary SQL into the backend database on the server.

  Tags:  day zero vulnerability tcp-port-443 management-interface backend-database  

• December 05, 2010
• 15:28

  Symantec IM Manager rdServer.dll sGetDefinition SQL Injection Vulnerability

   » ‎ SecuriTeam
  This vulnerability allows remote attackers to inject arbitrary SQL into the backend database on vulnerable installations of Symantec IM Manager.

  -

  Make your website safer. Use external penetration testing service. First report ready in one hour!

  Tags:  vulnerability symantec sql manager-rdserver safer-use backend-database attackers  

• October 28, 2010
• 1:01

  ZDI-10-226.txt

   » ‎ Packet Storm Security Recent Files
  Zero Day Initiative Advisory 10-226 - This vulnerability allows remote attackers to inject arbitrary SQL into the backend database on vulnerable installations of Symantec IM Manager. Authentication is not required to exploit this vulnerability. The specific flaw exists within the IM Manager interface exposed by the web server which listens by default on TCP port 80. The rdpageimlogic.aspx file does not validate the rdReport variable when parsing requests. It parses SQL statements from the file pointed to by this variable. A remote attacker can abuse this behavior to inject arbitrary SQL into the backend database.

  Tags:  vulnerability backend sql manager.-authentication tcp-port-80 manager-interface backend-database  

• 1:00

  ZDI-10-226.txt

   » ‎ Packet Storm Security Advisories
  Zero Day Initiative Advisory 10-226 - This vulnerability allows remote attackers to inject arbitrary SQL into the backend database on vulnerable installations of Symantec IM Manager. Authentication is not required to exploit this vulnerability. The specific flaw exists within the IM Manager interface exposed by the web server which listens by default on TCP port 80. The rdpageimlogic.aspx file does not validate the rdReport variable when parsing requests. It parses SQL statements from the file pointed to by this variable. A remote attacker can abuse this behavior to inject arbitrary SQL into the backend database.

  Tags:  vulnerability backend sql manager.-authentication tcp-port-80 manager-interface backend-database