Duware vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2008-2868 SQL injection vulnerability in detail.asp in DUware DUcalendar 1.0 and possibly earlier allows remote attackers to execute arbitrary SQL commands via the iEve pHigh 7.5 · Jun 26, 2008
• CVE-2006-6455 Multiple SQL injection vulnerabilities in admin/default.asp in DUware DUdirectory 3.1, and possibly DUdirectory Pro and Pro SQL 3.x, allow remote attackers to eHigh 7.5 · Dec 10, 2006
• CVE-2006-6365 SQL injection vulnerability in detail.asp in DUware DUpaypal 3.1, and possibly earlier, allows remote attackers to execute arbitrary SQL commands via the iType High 7.5 · Dec 7, 2006
• CVE-2006-6367 Multiple SQL injection vulnerabilities in detail.asp in DUware DUdownload 1.1, and possibly earlier, allow remote attackers to execute arbitrary SQL commands viHigh 7.5 · Dec 7, 2006
• CVE-2006-6354 Multiple SQL injection vulnerabilities in detail.asp in DuWare DuNews allow remote attackers to execute arbitrary SQL commands via the (1) iNews, (2) iType, or High 7.5 · Dec 6, 2006
• CVE-2006-6355 SQL injection vulnerability in default.asp in DuWare DuClassmate allows remote attackers to execute arbitrary SQL commands via the iCity parameter.High 10 · Dec 6, 2006
• CVE-2006-2302 SQL injection vulnerability in admin_default.asp in DUGallery 2.x allows remote attackers to execute arbitrary SQL commands via the (1) Login or (2) password fiHigh 7.5 · May 11, 2006
• CVE-2005-3976 SQL injection vulnerability in type.asp, as used in multiple DUware products including (1) DUamazon 3.1, (2) DUarticle 1.1, (3) DUclassified 4.2, (4) DUdirectorHigh 7.5 · Dec 3, 2005
• CVE-2005-2045 Multiple SQL injection vulnerabilities in DUware DUportal PRO 3.4.3 allow remote attackers to execute arbitrary SQL commands via the (1) iChannel parameter to dHigh 7.5 · Jun 22, 2005
• CVE-2005-2046 Multiple SQL injection vulnerabilities in DUware DUamazon Pro 3.0 and 3.1 allow remote attackers to execute arbitrary SQL commands via the (1) iCat parameter toHigh 7.5 · Jun 22, 2005
• CVE-2005-2047 Multiple SQL injection vulnerabilities in DUware DUpaypal Pro 3.0 allow remote attackers to execute arbitrary SQL commands via the (1) iCat parameter to cat.aspHigh 7.5 · Jun 22, 2005
• CVE-2005-2048 Multiple SQL injection vulnerabilities in DUware DUforum 3.1, and possibly other versions, allow remote attackers to execute arbitrary SQL commands via the (1) High 7.5 · Jun 22, 2005
• CVE-2005-2049 Multiple SQL injection vulnerabilities in DUware DUclassmate 1.2 allow remote attackers to execute arbitrary SQL commands via the (1) iState parameter to defaulHigh 7.5 · Jun 22, 2005
• CVE-2005-1224 Multiple SQL injection vulnerabilities in DUware DUportal Pro 3.4 allow remote attackers to execute arbitrary SQL commands via the (1) nChannel parameter to defHigh 7.5 · May 2, 2005
• CVE-2005-1236 Multiple SQL injection vulnerabilities in DUware DUportal 3.1.2 and 3.1.2 SQL allow remote attackers to execute arbitrary SQL commands via the (1) iChannel paraHigh 7.5 · May 2, 2005
• CVE-2004-2201 SQL injection vulnerability in DUware DUforum 3.0 through 3.1 allows remote attackers to execute arbitrary SQL commands via the FOR_ID parameter in messages.aspHigh 7.5 · Dec 31, 2004
• CVE-2004-2202 Multiple SQL injection vulnerabilities in DUware DUclassified 4.0 through 4.2 allows remote attackers to bypass authentication and execute other commands on theHigh 7.5 · Dec 31, 2004