Sql injection

SQL Injection exists in PHP Scripts Mall Select Your College Script 2.0.2 via a Login Parameter...

PT-2018-17788

Name of the Vulnerable Software and Affected Versions PHP Scripts Mall Select Your College Script version 2.0.2 Description A SQL Injection issue exists in the Login Parameter, allowing potential exploitation. Recommendations For version 2.0.2, consider restricting access to the Login Parameter t...

CVE-2018-6863: Improper Neutralization of Special Elements used in an SQL Command

SQL Injection exists in PHP Scripts Mall Select Your College Script 2.0.2 via a Login Parameter...

CVE-2016-0215

IBM DB2 9.7, 10.1 before FP6, and 10.5 before FP8 on AIX, Linux, HP, Solaris and Windows allow remote authenticated users to cause a denial of service daemon crash via a SELECT statement with a subquery containing the AVG OLAP function on an Oracle compatible database...

Code injection

IBM DB2 9.7, 10.1 before FP6, and 10.5 before FP8 on AIX, Linux, HP, Solaris and Windows allow remote authenticated users to cause a denial of service daemon crash via a SELECT statement with a subquery containing the AVG OLAP function on an Oracle compatible database...

CVE-2016-0215: Improper Input Validation

IBM DB2 9.7, 10.1 before FP6, and 10.5 before FP8 on AIX, Linux, HP, Solaris and Windows allow remote authenticated users to cause a denial of service daemon crash via a SELECT statement with a subquery containing the AVG OLAP function on an Oracle compatible database...

PT-2018-4586

Name of the Vulnerable Software and Affected Versions IBM DB2 versions 9.7, 10.1 before FP6, and 10.5 before FP8 Description The issue allows remote authenticated users to cause a denial of service, resulting in a daemon crash, by executing a SELECT statement with a subquery containing the AVG OL...

CVE-2018-5696

The iJoomla comadagency plugin 6.0.9 for Joomla! allows SQL injection via the advertiserstatus and statusselect parameters to index.php...

PT-2018-17093 · Joomla · Com Adagency

Name of the Vulnerable Software and Affected Versions: com adagency plugin version 6.0.9 for Joomla! Description: The issue allows SQL injection via the advertiser status and status select parameters to "index.php". This can potentially lead to unauthorized access to sensitive data...

[SECURITY] Fedora 27 Update: sensible-utils-0.0.11-1.fc27

This package provides a number of small utilities which are used by program s to sensibly select and spawn an appropriate browser, editor, or pager...

Design/Logic Flaw

In Apache Fineract 0.4.0-incubating, 0.5.0-incubating, and 0.6.0-incubating, an authenticated user with client/loan/center/staff/group read permissions is able to inject malicious SQL into SELECT queries. The 'sqlSearch' parameter on a number of endpoints is not sanitized and appended directly to...

CVE-2017-5663

CVE-2017-5663 affects Apache Fineract 0.4.0-incubating, 0.5.0-incubating, and 0.6.0-incubating. An authenticated user with read permissions on client/loan/center/staff/group can inject malicious SQL into SELECT queries via the sqlSearch parameter across several endpoints where input is appended d...

CVE-2017-5663

In Apache Fineract 0.4.0-incubating, 0.5.0-incubating, and 0.6.0-incubating, an authenticated user with client/loan/center/staff/group read permissions is able to inject malicious SQL into SELECT queries. The 'sqlSearch' parameter on a number of endpoints is not sanitized and appended directly to...

CVE-2017-5663: Improper Neutralization of Special Elements used in an SQL Command

In Apache Fineract 0.4.0-incubating, 0.5.0-incubating, and 0.6.0-incubating, an authenticated user with client/loan/center/staff/group read permissions is able to inject malicious SQL into SELECT queries. The 'sqlSearch' parameter on a number of endpoints is not sanitized and appended directly to...

Freelance Website Script 2.0.6 - 'pr_id' / 'catid' SQL Injection

Exploit Title: Freelance Website Script 2.0.6 - SQL Injection Dork: N/A Date: 08.12.2017 Vendor Homepage: https://www.phpscriptsmall.com/ Software Link: https://www.phpscriptsmall.com/product/freelance-website-script/ Version: 2.0.6 Category: Webapps Tested on: WiN7x64/KaLiLinuXx64 CVE: N/A Explo...

Applicative Protocol Multiplexer: SSLH

sslh accepts connections on specified ports, and forwards them further based on tests performed on the first data packet sent by the remote client. Probes for HTTP, SSL, SSH, OpenVPN, tinc, XMPP are implemented, and any other protocol that can be tested using a regular expression, can be...

Ruby on Rails: ActionController::Parameters .each returns an unsafe hash

Rails 5.1.4 The goal of ActionController::Parameters's permit method strong parameters is to prevent accidental trust in the parameters sent by the client. We can therefore not simply create a hash of all the parameters in the params without permitting them first. When we really want to do this...

CVE-2017-15099

INSERT ... ON CONFLICT DO UPDATE commands in PostgreSQL 10.x before 10.1, 9.6.x before 9.6.6, and 9.5.x before 9.5.10 disclose table contents that the invoker lacks privilege to read. These exploits affect only tables where the attacker lacks full read access but has both INSERT and UPDATE...

Ubuntu: Security Advisory (USN-3479-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

kernel: Divide-by-zero in __tcp_select_window

A divide-by-zero vulnerability was found in the tcpselectwindow function in the Linux kernel. This can result in a kernel panic causing a local denial of service...