Vulnerabilities > Duware

DATE CVE VULNERABILITY TITLE RISK
2008-06-26 CVE-2008-2868 SQL Injection vulnerability in Duware Ducalendar
SQL injection vulnerability in detail.asp in DUware DUcalendar 1.0 and possibly earlier allows remote attackers to execute arbitrary SQL commands via the iEve parameter.
network
low complexity
duware CWE-89
7.5
2006-12-10 CVE-2006-6455 SQL Injection vulnerability in DUDirectory
Multiple SQL injection vulnerabilities in admin/default.asp in DUware DUdirectory 3.1, and possibly DUdirectory Pro and Pro SQL 3.x, allow remote attackers to execute arbitrary SQL commands via the (1) Username or (2) Password parameter.
network
low complexity
duware
7.5
2006-12-07 CVE-2006-6367 SQL Injection vulnerability in Duware Dudownload, Dunews and Dupaypal
Multiple SQL injection vulnerabilities in detail.asp in DUware DUdownload 1.1, and possibly earlier, allow remote attackers to execute arbitrary SQL commands via the (1) iFile or (2) action parameter.
network
low complexity
duware CWE-89
7.5
2006-12-07 CVE-2006-6365 SQL Injection vulnerability in DUware DUpaypal Pro
SQL injection vulnerability in detail.asp in DUware DUpaypal 3.1, and possibly earlier, allows remote attackers to execute arbitrary SQL commands via the iType parameter.
network
low complexity
duware
7.5
2006-12-07 CVE-2006-6355 SQL Injection vulnerability in DUClassmate ICity Parameter
SQL injection vulnerability in default.asp in DuWare DuClassmate allows remote attackers to execute arbitrary SQL commands via the iCity parameter.
network
low complexity
duware
critical
10.0
2006-12-07 CVE-2006-6354 Software SQL Injection vulnerability in DUware
Multiple SQL injection vulnerabilities in detail.asp in DuWare DuNews allow remote attackers to execute arbitrary SQL commands via the (1) iNews, (2) iType, or (3) Action parameter.
network
low complexity
duware
7.5
2006-08-31 CVE-2006-4487 Information Disclosure vulnerability in Dupoll 3.0/3.1
DUware DUpoll 3.0 and 3.1 stores _private/Dupoll.mdb under the web document root with insufficient access control, which allows remote attackers to obtain sensitive information such as usernames and passwords.
network
low complexity
duware
5.0
2006-05-17 CVE-2006-2428 Unspecified vulnerability in Duware Dubanner 3.1
add.asp in DUware DUbanner 3.1 allows remote attackers to execute arbitrary code by uploading files with arbitrary extensions, such as ASP files, probably due to client-side enforcement that can be bypassed.
network
low complexity
duware
6.4
2006-05-11 CVE-2006-2302 SQL Injection vulnerability in DUWare DUGallery Login
SQL injection vulnerability in admin_default.asp in DUGallery 2.x allows remote attackers to execute arbitrary SQL commands via the (1) Login or (2) password field.
network
low complexity
duware
7.5
2006-05-01 CVE-2006-2132 SQL Injection vulnerability in DUclassified Detail.ASP
SQL injection vulnerability in detail.asp in DUclassified allows remote attackers to execute arbitrary SQL commands via the iPro parameter.
network
low complexity
duware
6.4