info.cqframework:elm-fhir (1.5.4), org.opencds.cqf.cql.ls:cql-ls (1.5.2) +1 more potentially affected by CVE-2024-51132 via ca.uhn.hapi.fhir:org.hl7.fhir.validation (5.4.8)

ca.uhn.hapi.fhir:org.hl7.fhir.validation MAVEN version 5.4.8 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.validation and may be impacted: - info.cqframework:elm-fhir 1.5.4 - org.opencds.cqf.cql.ls:cql-ls 1.5.2 -...

info.cqframework:elm-fhir (>=1.5.5, <=1.5.7), org.opencds.cqf.cql.ls:cql-ls (>=1.5.3, <=1.5.4) +1 more potentially affected by CVE-2024-51132 via ca.uhn.hapi.fhir:org.hl7.fhir.validation (5.5.16)

ca.uhn.hapi.fhir:org.hl7.fhir.validation MAVEN version 5.5.16 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.validation and may be impacted: - info.cqframework:elm-fhir =1.5.5, =1.5.3, =1.5.3, =1.5.4 Source cves:...

ca.uhn.hapi.fhir:org.hl7.fhir.convertors (5.4.8), ca.uhn.hapi.fhir:org.hl7.fhir.validation (5.4.8) +3 more potentially affected by CVE-2024-45294 +1 more via ca.uhn.hapi.fhir:org.hl7.fhir.r5 (5.4.8)

ca.uhn.hapi.fhir:org.hl7.fhir.r5 MAVEN version 5.4.8 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.r5 and may be impacted: - ca.uhn.hapi.fhir:org.hl7.fhir.convertors 5.4.8 - ca.uhn.hapi.fhir:org.hl7.fhir.validation 5.4.8...

SUSE CVE-2021-47079

In the Linux kernel, the following vulnerability has been resolved: platform/x86: ideapad-laptop: fix a NULL pointer dereference The third parameter of dytccqlcommand should not be NULL since it will be dereferenced immediately...

CVE-2021-47079

In the Linux kernel, the following vulnerability has been resolved: platform/x86: ideapad-laptop: fix a NULL pointer dereference The third parameter of dytccqlcommand should not be NULL since it will be dereferenced immediately...

CVE-2024-27284

cassandra-rs is a Cassandra CQL driver for Rust. Code that attempts to use an item e.g., a row returned by an iterator after the iterator has advanced to the next item will be accessing freed memory and experience undefined behaviour. The problem has been fixed in version 3.0.0...

GHSA-7G5F-WRX8-5CCF GeoServer OGC Filter SQL Injection Vulnerabilities

Impact GeoServer includes support for the OGC Filter expression language and the OGC Common Query Language CQL as part of the Web Feature Service WFS and Web Map Service WMS protocols. CQL is also supported through the Web Coverage Service WCS protocol for ImageMosaic coverages. SQL Injection...

CVE-2023-25157

GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. GeoServer includes support for the OGC Filter expression language and the OGC Common Query Language CQL as part of the Web Feature Service WFS and Web Map Service WMS protocols. CQL is...

Code injection

GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. GeoServer includes support for the OGC Filter expression language and the OGC Common Query Language CQL as part of the Web Feature Service WFS and Web Map Service WMS protocols. CQL is...

CVE-2023-25157

GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. GeoServer includes support for the OGC Filter expression language and the OGC Common Query Language CQL as part of the Web Feature Service WFS and Web Map Service WMS protocols. CQL is...

CVE-2023-25157 Unfiltered SQL Injection Vulnerabilities in Geoserver

GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. GeoServer includes support for the OGC Filter expression language and the OGC Common Query Language CQL as part of the Web Feature Service WFS and Web Map Service WMS protocols. CQL is...

CVE-2023-25157

GeoServer , an open-source geospatial data server, is vulnerable to SQL injection due to a lack of input filtering in the OGC Filter expression language and CQL (Common Query Language). The vulnerability resides in the CQL Parser & SQL Translator layer, where malformed filter syntax can bypass le...

PT-2023-2269

Name of the Vulnerable Software and Affected Versions GeoServer versions prior to 2.21.4 GeoServer versions prior to 2.22.2 GeoServer versions prior to 2.20.7 GeoServer versions prior to 2.19.7 GeoServer versions prior to 2.18.7 Description The issue is related to SQL injection vulnerabilities in...

CVE-2023-25157: Improper Neutralization of Special Elements used in an SQL Command

GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. GeoServer includes support for the OGC Filter expression language and the OGC Common Query Language CQL as part of the Web Feature Service WFS and Web Map Service WMS protocols. CQL is...

CVE-2022-29240

Scylla is a real-time big data database that is API-compatible with Apache Cassandra and Amazon DynamoDB. When decompressing CQL frame received from user, Scylla assumes that user-provided uncompressed length is correct. If user provides fake length, that is greater than the real one, part of...

Authentication flaw

Scylla is a real-time big data database that is API-compatible with Apache Cassandra and Amazon DynamoDB. When decompressing CQL frame received from user, Scylla assumes that user-provided uncompressed length is correct. If user provides fake length, that is greater than the real one, part of...

CVE-2022-29240

The CVE-2022-29240 issue is an uninitialized memory read during LZ4 decompression of a CQL frame in Scylla. If a user supplies a forged uncompressed length, part of the decompression buffer can remain uninitialized, enabling exploitation based on privileges. Reported impacts include an authentica...

CVE-2022-29240

Scylla is a real-time big data database that is API-compatible with Apache Cassandra and Amazon DynamoDB. When decompressing CQL frame received from user, Scylla assumes that user-provided uncompressed length is correct. If user provides fake length, that is greater than the real one, part of...

CVE-2022-29240: Use of Uninitialized Resource

Scylla is a real-time big data database that is API-compatible with Apache Cassandra and Amazon DynamoDB. When decompressing CQL frame received from user, Scylla assumes that user-provided uncompressed length is correct. If user provides fake length, that is greater than the real one, part of...

PT-2022-19490 · Scylla +2 · Scylla Enterprise +3

Name of the Vulnerable Software and Affected Versions: Scylla Enterprise versions prior to 2020.1.14 Scylla Enterprise versions prior to 2021.1.12 Scylla Enterprise version 2022.1.0 Scylla Open Source versions prior to 4.6.7 Scylla Open Source versions prior to 5.0.3 Description: Scylla is a...