This exploit allows the attacker to grant or revoke dba permission to an unprivileged user in Oracle SYS.LT.FINDRICSET (11g/10g). It uses the 'evil cursor injection' technique and does not require the 'create procedure' privilege. The exploit has been tested on Oracle Database 10g Enterprise Edition Release 10.1.0.5.0. It was fixed with CPU Oct. 2007.
The exploit allows an attacker to cause a Denial of Service (DoS) by running a python code which writes a large buffer to a file, causing the Navicat application to crash when it tries to open the file.
The Open Faculty Evaluation System 5.6 is vulnerable to SQL Injection. The 'batch_name' parameter in the 'submit_feedback.php' script is not properly validated, allowing an attacker to inject malicious SQL queries.
This exploit allows an attacker to grant or revoke dba permission to an unprivileged user in Oracle databases. It has been tested on Oracle Database 10g Enterprise Edition Release 10.1.0.5.0. The vulnerability was fixed with CPU Oct. 2007. The exploit requires Oracle InstantClient (basic + sdk) for DBD::Oracle.
The MPS Box version 0.1.8.0 allows an attacker to upload arbitrary files via the device_add.php script. This can lead to remote code execution or unauthorized access to sensitive information.
libtiff up to and including 4.0.9 decodes arbitrarily-sized JBIG into a buffer, ignoring the buffer size. This allows an attacker to perform an allocation of a size of his choosing and write arbitrary data into the buffer.
This exploit is for CA BrightStor HSM version <= r11.5 on Windows XP (SP2 Professional) and Windows Server 2003 (Enterprise Edition). It allows for a remote stack-based overflow and denial of service (DoS) attack. The exploit code is released by NiceNameCrew and discovered by iDefense.
The Adult Filter 1.0 software is vulnerable to a buffer overflow vulnerability, specifically a Stack-based Buffer Overflow. This vulnerability allows an attacker to execute arbitrary code on the target system by sending a specially crafted request that exceeds the buffer size allocated for processing the request. This can lead to remote code execution, giving the attacker full control over the affected system.
Phptpoint hospital management system suffers from multiple SQL injection vulnerabilities that allow an attacker to bypass the login page and authenticate with admin, and then easily get database information or execute arbitrary commands.
In the 3.1 version of Ekushey Project Manager CRM, Stored XSS has been discovered in the input and upload sections, as demonstrated by the name parameter to the index.php/admin/client/create URI.
Services By CQR