Debian: Security Advisory (DLA-3731-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] [DLA 3731-1] man-db: fix sandboxing issues

Debian LTS Advisory DLA-3731-1 [email protected] https://www.debian.org/lts/security/ Colin Watson February 01, 2024 https://wiki.debian.org/LTS Package : man-db Version : 2.8.5-2+deb10u1 CVE ID : Debian Bug : 926450 948238 1061870 man-db provides the "man" command used for reading manu...

Debian dla-3731 : man-db - security update

The remote Debian 10 host has a package installed that is affected by a vulnerability as referenced in the dla-3731 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-3731-1 [email protected] https://www.debian.org/lts/security/...

BIT-CODEIGNITER-2022-40827

B.C. Institute of Technology CodeIgniter =3.1.13 is vulnerable to SQL Injection via system\database\DBquerybuilder.php where function...

CVE-2024-0989

A vulnerability, which was classified as problematic, has been found in Sichuan Yougou Technology KuERP up to 1.0.4. Affected by this issue is the function delsndb of the file /application/index/controller/Service.php. The manipulation of the argument file leads to path traversal: '../filedir'. T...

CVE-2023-40551

A flaw was found in the MZ binary format in Shim. An out-of-bounds read may occur, leading to a crash or possible exposure of sensitive data during the system's boot phase...

PT-2024-40357

Name of the Vulnerable Software and Affected Versions SurrealDB versions prior to 1.1.0 Description The issue affects the SurrealDB HTTP REST API, where the ID, DB, and NS headers fail to parse when containing special characters, causing a panic that crashes the SurrealDB server, leading to denia...

PT-2024-1164

Name of the Vulnerable Software and Affected Versions Oracle E-Business Suite versions 12.2.3 through 12.2.13 Description The issue is related to insufficient input validation in the DB Privileges component of the Oracle Application Object Library. This can allow a remote attacker to gain...

cinema-italiano-db.de Cross Site Scripting vulnerability OBB-3830355

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

PT-2024-2000

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The vulnerability is related to the hisi acc vfio pci module in the Linux kernel. When the optional PRE COPY support was added to speed up the device compatibility check, it failed to...

PrestaShop XSS can be stored in DB from "add a message form" in order detail page (FO)

Impact The isCleanHtml method is not used on this this form, which makes it possible to store an xss in DB. The impact is low because the html is not interpreted in BO, thanks to twig's escape mechanism. In FO, the xss is effective, but only impacts the customer sending it, or the customer sessio...

GHSA-VR7M-R9VM-M4WF PrestaShop XSS can be stored in DB from "add a message form" in order detail page (FO)

Impact The isCleanHtml method is not used on this this form, which makes it possible to store an xss in DB. The impact is low because the html is not interpreted in BO, thanks to twig's escape mechanism. In FO, the xss is effective, but only impacts the customer sending it, or the customer sessio...

CVE-2023-52286

Tencent tdsqlpcloud through 1.8.5 allows unauthenticated remote attackers to discover database credentials via an index.php/api/install/getdbinfo request, a related issue to CVE-2023-42387...

CVE-2023-52082 Lychee is vulnerable to an SQL Injection in explain DB queries.

Lychee is a free photo-management tool. Prior to 5.0.2, Lychee is vulnerable to an SQL injection on any binding when using mysql/mariadb. This injection is only active for users with the .env settings set to DBLOGSQL=true and DBLOGSQLEXPLAIN=true. The defaults settings of Lychee are safe. The pat...

CVE-2023-52082 Lychee is vulnerable to an SQL Injection in explain DB queries.

Lychee is a free photo-management tool. Prior to 5.0.2, Lychee is vulnerable to an SQL injection on any binding when using mysql/mariadb. This injection is only active for users with the .env settings set to DBLOGSQL=true and DBLOGSQLEXPLAIN=true. The defaults settings of Lychee are safe. The pat...

PT-2023-31914

Name of the Vulnerable Software and Affected Versions Lychee versions prior to 5.0.2 Description Lychee, a free photo-management tool, is vulnerable to an SQL injection on any binding when using mysql/mariadb. This injection is only active for users with the .env settings set to DB LOG SQL=true a...

CVE-2023-29096

CVE-2023-29096 affects the WordPress plugin Contact Form to DB by BestWebSoft – Messages Database, with an SQL Injection due to improper neutralization of input in an SQL command. Affected versions:

CVE-2023-29096: Improper Neutralization of Special Elements used in an SQL Command

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in BestWebSoft Contact Form to DB by BestWebSoft – Messages Database Plugin For WordPress.This issue affects Contact Form to DB by BestWebSoft – Messages Database Plugin For WordPress: from n/a throug...

CVE-2021-42797

Path traversal vulnerability in AVEVA Edge formerly InduSoft Web Studio versions R2020 and prior allows an unauthenticated user to steal the Windows access token of the user account configured for accessing external DB resources...

Path traversal

Path traversal vulnerability in AVEVA Edge formerly InduSoft Web Studio versions R2020 and prior allows an unauthenticated user to steal the Windows access token of the user account configured for accessing external DB resources...