CVE-2022-33061: Improper Neutralization of Special Elements used in an SQL Command

Online Railway Reservation System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /classes/Master.php?f=deleteservice...

PT-2022-21671

Name of the Vulnerable Software and Affected Versions Online Railway Reservation System version 1.0 Description The issue is related to a SQL injection vulnerability. It can be exploited via the id parameter at the "/classes/Master.php?f=delete message" endpoint. Recommendations For Online Railwa...

Input validation

Pimcore is an Open Source Data & Experience Management Platform. Pimcore offers developers listing classes to make querying data easier. This listing classes also allow to order or group the results based on one or more columns which should be quoted by default. The actual issue is that quoting i...

CVE-2022-31092 SQL injection in pimcore

Pimcore is an Open Source Data & Experience Management Platform. Pimcore offers developers listing classes to make querying data easier. This listing classes also allow to order or group the results based on one or more columns which should be quoted by default. The actual issue is that quoting i...

CVE-2022-31092

Pimcore is an Open Source Data & Experience Management Platform. Pimcore offers developers listing classes to make querying data easier. This listing classes also allow to order or group the results based on one or more columns which should be quoted by default. The actual issue is that quoting i...

CVE-2022-31084 Unauthenticated Remote Code Execution in ldap-account-manager

LDAP Account Manager LAM is a webfrontend for managing entries e.g. users, groups, DHCP settings stored in an LDAP directory. In versions prior to 8.0 There are cases where LAM instantiates objects from arbitrary classes. An attacker can inject the first constructor argument. This can lead to cod...

CVE-2022-31092: Improper Neutralization of Special Elements used in an SQL Command

Pimcore is an Open Source Data & Experience Management Platform. Pimcore offers developers listing classes to make querying data easier. This listing classes also allow to order or group the results based on one or more columns which should be quoted by default. The actual issue is that quoting i...

SUSE: Security Advisory (SUSE-SU-2022:2174-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

com.google.code.gson-gson: Deserialization of Untrusted Data in com.google.code.gson-gson

A flaw was found in gson, which is vulnerable to Deserialization of Untrusted Data via the writeReplace method in internal classes. This issue may lead to availability attacks...

SQL Injection

pimcore/pimcore is vulnerable to sql injection. The vulnerability exists due to improper quoting of columns in setOrderKey function and setGroupBy function of AbstractListing.php when using setOrderBy or setGroupBy on listing classes...

Improper quoting of columns when using setOrderBy() or setGroupBy() on listing classes in Pimcore

Impact Pimcore offers developers listing classes to make querying data easier. This listing classes also allow to order or group the results based on one or more columns which should be quoted by default. The actual issue is that quoting is not done properly in both cases, so there's the...

GHSA-GVMF-WCX6-P974 Improper quoting of columns when using setOrderBy() or setGroupBy() on listing classes in Pimcore

Impact Pimcore offers developers listing classes to make querying data easier. This listing classes also allow to order or group the results based on one or more columns which should be quoted by default. The actual issue is that quoting is not done properly in both cases, so there's the...

PT-2022-20520

Name of the Vulnerable Software and Affected Versions Pimcore versions prior to 10.4.4 Description Pimcore is an Open Source Data & Experience Management Platform that offers developers listing classes to make querying data easier. These listing classes allow ordering or grouping results based on...

CVE-2022-31911: Improper Neutralization of Special Elements used in an SQL Command

Online Discussion Forum Site v1.0 is vulnerable to SQL Injection via /odfs/classes/Master.php?f=deleteteam...

CVE-2022-31912: Improper Neutralization of Special Elements used in an SQL Command

Online Tutor Portal Site v1.0 is vulnerable to SQL Injection via /otps/classes/Master.php?f=deleteteam...

PT-2022-20986

Name of the Vulnerable Software and Affected Versions Online Tutor Portal Site version 1.0 Description The issue concerns a SQL Injection vulnerability via the "/otps/classes/Master.php?f=delete team" API endpoint. This allows for potential unauthorized access and manipulation of database content...

CVE-2022-31910: Improper Neutralization of Input During Web Page Generation

Online Tutor Portal Site v1.0 is vulnerable to Cross Site Scripting XSS. via /otps/classes/Master.php...

CVE-2022-31913: Improper Neutralization of Input During Web Page Generation

Online Discussion Forum Site v1.0 is vulnerable to Cross Site Scripting XSS via /odfs/classes/Master.php?f=savecategory, name...

PT-2022-20981

Name of the Vulnerable Software and Affected Versions Online Fire Reporting System version 1.0 Description The issue concerns a Cross Site Scripting XSS vulnerability. It can be exploited via the API endpoint "/ofrs/classes/Master.php". Recommendations For Online Fire Reporting System version 1.0...

PT-2022-20984

Name of the Vulnerable Software and Affected Versions Online Tutor Portal Site version 1.0 Description The issue is related to Cross Site Scripting XSS via the "/otps/classes/Master.php" endpoint. This allows for potential malicious script execution. Recommendations For Online Tutor Portal Site...