5749 matches found
CVE-2025-32327
The MediaProvider component in the Android operating system is vulnerable to an SQL injection flaw within multiple functions of the PickerDbFacade.java module. This occurs due to a lack of protective measures for the SQL query structure , which can allow an attacker to perform unauthorized data a...
DEBIAN-CVE-2025-38697
In the Linux kernel, the following vulnerability has been resolved: jfs: upper bound check of tree index in dbAllocAG When computing the tree index in dbAllocAG, we never check if we are out of bounds realative to the size of the stree. This could happen in a scenario where the filesystem metadat...
CVE-2025-41063: Improper Neutralization of Input During Web Page Generation
A vulnerability has been discovered in version 4.0.5 of appRain CMF, consisting of an authenticated reflected XSS due to a lack of proper validation of user input, through the 's' parameter in /apprain/developer/debug-log/db...
Linux Distros Unpatched Vulnerability : CVE-2016-6233
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The 1 order and 2 group methods in ZendDbSelect in the Zend Framework before 1.12.19 might allow remote attackers to conduct SQL injection attacks via vectors...
Malicious code in advisory_db_toolkit (RubyGems)
--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 6f9757e1ad29ad430d32886a0fcfa47e48a29e5e4af901f48e305216133028e6 The OpenSSF Package Analysis project identified 'advisorydbtoolkit' @ 99.99.99 rubygems as malicious. It is considered malicious because: - The...
Linux Distros Unpatched Vulnerability : CVE-2019-13274
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In Xymon through 4.3.28, an XSS vulnerability exists in the csvinfo CGI script due to insufficient filtering of the db parameter. CVE-2019-13274 Note that Nessu...
Linux Distros Unpatched Vulnerability : CVE-2021-46019
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An untrusted pointer dereference in recdbdestroy at rec-db.c of GNU Recutils v1.8.90 can lead to a segmentation fault or application crash. CVE-2021-46019 Note...
CVE-2025-57773 Dataease DB2 Aspectweaver Deserialization Arbitrary File Write Vulnerability
DataEase is an open source business intelligence and data visualization tool. Prior to version 2.10.12, because DB2 parameters are not filtered, a JNDI injection attack can be directly launched. JNDI triggers an AspectJWeaver deserialization attack, writing to various files. This vulnerability...
Linux Distros Unpatched Vulnerability : CVE-2011-3699
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - John Lim ADOdb Library for PHP 5.11 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation...
CVE-2025-50567: Improper Neutralization of Special Elements used in an SQL Command
Saurus CMS Community Edition 4.7.1 contains a vulnerability in the custom DB::prepare function, which uses pregreplace with the deprecated /e eval modifier to interpolate SQL query parameters. This leads to injection of user-controlled SQL statements, potentially leading to arbitrary PHP code...
CVE-2025-55282
The CVE-2025-55282 issue affects aiven-db-migrate (prior to 1.0.7). A privilege-escalation flaw exists due to a lack of search_path restriction during migrations from untrusted sources, enabling a user to override pg_catalog and execute untrusted operators as a PostgreSQL superuser. This is fixed...
CVE-2025-55282 aiven-db-migrate allows Privilege Escalation via unrestricted search_path during migration
aiven-db-migrate is an Aiven database migration tool. Prior to 1.0.7, there is a privilege escalation vulnerability that allows a user to elevate to superuser inside PostgreSQL databases during a migration from an untrusted source server. By exploiting a lack of searchpath restriction, an attacke...
PT-2025-33673 · Aiven · Aiven-Db-Migrate
Name of the Vulnerable Software and Affected Versions: aiven-db-migrate versions prior to 1.0.7 Description: aiven-db-migrate is a database migration tool. A privilege escalation issue exists that could allow elevation to superuser inside PostgreSQL databases during a migration from an untrusted...
CVE-2025-55282: Improper Limitation of a Pathname to a Restricted Directory
aiven-db-migrate is an Aiven database migration tool. Prior to 1.0.7, there is a privilege escalation vulnerability that allows a user to elevate to superuser inside PostgreSQL databases during a migration from an untrusted source server. By exploiting a lack of searchpath restriction, an attacke...
aiven-db-migrate 命令注入漏洞
aiven-db-migrate is an Aiven open source application. A command injection vulnerability exists in aiven-db-migrate versions prior to 1.0.7, which stems from an elevation of privilege vulnerability that could lead to superuser privilege acquisition...
CVE-2025-55283: Improper Neutralization of Special Elements used in a Command
aiven-db-migrate is an Aiven database migration tool. Prior to 1.0.7, there is a privilege escalation vulnerability that allows elevation to superuser inside PostgreSQL databases during a migration from an untrusted source server. The vulnerability stems from psql executing commands embedded in a...
CVE-2025-55194
Part-DB is an open source inventory management system for electronic components. Prior to version 1.17.3, any authenticated user can upload a profile picture with a misleading file extension e.g., .jpg.txt, resulting in a persistent 500 Internal Server Error when attempting to view or edit that...
Malicious code in @zalastax/nolb-db (npm)
The package @zalastax/nolb-db was found to contain malicious code...