CVE-2020-5248

GLPI before before version 9.4.6 has a vulnerability involving a default encryption key. GLPIKEY is public and is used on every instance. This means anyone can decrypt sensitive data stored using this key. It is possible to change the key before installing GLPI. But on existing instances, data mu...

Shopify: IDOR on stocky application-Low Stock-Varient-Settings-Columns

Hello, I have found a IDOR on stocky application Low Stock-Varient-Settings-Columns attribute, in fact malicious user can change the columns of another user. POC: 1Create two user A and B, login to A and create a store, test.myshopify.com login to user B and create a store test1.myshopify.com...

Update Rollup 3 for System Center 2012 R2 Operations Manager

Update Rollup 3 for System Center 2012 R2 Operations Manager Introduction This article describes the issues that are fixed in Update Rollup 3 for Microsoft System Center 2012 R2 Operations Manager. Additionally, this article contains the installation instructions for Update Rollup 3 for System...

Unspecified Vulnerability in CIPPlanner CIPAce (CNVD-2020-21814)

CIPPlanner CIPAce is a suite of business process automation and application development platforms from the US-based CIPPlanner. A security vulnerability exists in CIPPlanner CIPAce version 9.1 Build 2019092801. The vulnerability can be exploited by an attacker to obtain information from specific...

CVE-2020-11592

An issue was discovered in CIPPlanner CIPAce 9.1 Build 2019092801. An unauthenticated attacker can make an API request and get the columns of a specific table within the CIP database...

Cross site request forgery (csrf)

An issue was discovered in CIPPlanner CIPAce 9.1 Build 2019092801. An unauthenticated attacker can make an API request and get the columns of a specific table within the CIP database...

ImageMagick: heap-based buffer overflow in WriteSGIImage in coders/sgi.c

A heap-based buffer overflow flaw was discovered in ImageMagick when writing SGI images with improper columns and rows properties. An attacker may trick a victim user into downloading a malicious image file and running it through ImageMagick, possibly executing code onto the victim user's system...

Input validation

A CSV injection in arxes-tolina 3.0.0 allows malicious users to gain remote control of other computers. By entering formula code in the following columns: Kundennummer, Firma, Street, PLZ, Ort, Zahlziel, and Bemerkung, an attacker can create a user with a name that contains malicious code. Other...

CVE-2019-19676

A CSV injection in arxes-tolina 3.0.0 allows malicious users to gain remote control of other computers. By entering formula code in the following columns: Kundennummer, Firma, Street, PLZ, Ort, Zahlziel, and Bemerkung, an attacker can create a user with a name that contains malicious code. Other...

DEBIAN-CVE-2020-9327

In SQLite 3.31.1, isAuxiliaryVtabOperator allows attackers to trigger a NULL pointer dereference and segmentation fault because of generated column optimizations...

Mail.ru: Ability to find out the name of the database table and its columns

Verbose errors were not disabled on api.iconjob.co An attacker can learn the name of a database table and its columns from an error message. This can help implement other SQL injection type attacks...

EulerOS 2.0 SP8 : sqlite (EulerOS-SA-2020-1033)

According to the version of the sqlite packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - pragma.c in SQLite through 3.30.1 mishandles NOT NULL in an integritycheck PRAGMA command in certain cases of generated columns.CVE-2019-19646 Note...

CVE-2019-19646

pragma.c in SQLite through 3.30.1 mishandles NOT NULL in an integritycheck PRAGMA command in certain cases of generated columns...

CVE-2019-19646

pragma.c in SQLite through 3.30.1 mishandles NOT NULL in an integritycheck PRAGMA command in certain cases of generated columns...

AZL-38566 CVE-2019-19646 affecting package ceph for versions less than 18.2.1-1

pragma.c in SQLite through 3.30.1 mishandles NOT NULL in an integritycheck PRAGMA command in certain cases of generated columns...

CVE-2019-19646

pragma.c in SQLite through 3.30.1 mishandles NOT NULL in an integritycheck PRAGMA command in certain cases of generated columns...

CVE-2019-19646

pragma.c in SQLite through 3.30.1 mishandles NOT NULL in an integritycheck PRAGMA command in certain cases of generated columns...

CVE-2019-19646

pragma.c in SQLite through 3.30.1 mishandles NOT NULL in an integritycheck PRAGMA command in certain cases of generated columns...

CVE-2019-19646

pragma.c in SQLite through 3.30.1 mishandles NOT NULL in an integritycheck PRAGMA command in certain cases of generated columns...

WordPress codepress-admin-columns injection vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers. codepress-admin-columns is a content management plugin used in it. An injection vulnerability exists in WordPress...