4516 matches found
The vulnerability of Fortinet FortiWLM, a centralized management system for WLAN access points and LAN switches, stems from the lack of protective measures for the SQL query structure. This allows attackers to execute arbitrary SQL queries against the database.
The vulnerability of Fortinet FortiWLM, a centralized management system for WLAN access points and LAN switches, relates to the lack of security measures for the SQL query structure. Exploiting this vulnerability allows an attacker to execute arbitrary SQL queries against the database remotely...
CVE-2023-6105
An information disclosure vulnerability exists in multiple ManageEngine products that can result in encryption keys being exposed. A low-privileged OS user with access to the host where an affected ManageEngine product is installed can view and use the exposed key to decrypt product database...
PT-2023-32519
Name of the Vulnerable Software and Affected Versions ManageEngine products affected versions not specified Description An information disclosure issue exists in multiple ManageEngine products, resulting in the exposure of encryption keys. A low-privileged OS user with access to the host where an...
CVE-2023-6105: Exposure of Sensitive Information to an Unauthorized Actor
An information disclosure vulnerability exists in multiple ManageEngine products that can result in encryption keys being exposed. A low-privileged OS user with access to the host where an affected ManageEngine product is installed can view and use the exposed key to decrypt product database...
CVE-2023-46601
A vulnerability has been identified in COMOS All versions. The affected application lacks proper access controls in making the SQLServer connection. This could allow an attacker to query the database directly to access information that the user should not have access to...
Design/Logic Flaw
A vulnerability has been identified in COMOS All versions. The affected application lacks proper access controls in making the SQLServer connection. This could allow an attacker to query the database directly to access information that the user should not have access to...
OSS Calendar vulnerable to SQL injection
Overview OSS Calendar provided by Thinkingreed Inc. contains an SQL injection vulnerability CWE-89. Shogo Iyota of Mitsui Bussan Secure Directions, Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership. Impact A...
CVE-2023-47609: Improper Neutralization of Special Elements used in an SQL Command
SQL injection vulnerability in OSS Calendar versions prior to v.2.0.3 allows a remote authenticated attacker to execute arbitrary code or obtain and/or alter the information stored in the database by sending a specially crafted request...
EMSigner OSS Calendar Security Vulnerability
EMSigner OSS Calendar is a calendar application from EMSigner Japan. A security vulnerability exists in EMSigner OSS Calendar prior to version v.2.0.3, which stems from the presence of a SQL injection vulnerability. An attacker can exploit this vulnerability by sending a specially crafted request...
SQL Injection
Piccolo is vulnerable to SQL Injection. The vulnerability is caused by a lack of user input validation while executing SQL statements. The input passed to connection.execute is not properly escaped. An attacker can exploit this vulnerability to obtain direct access to the database and has the...
PT-2023-6888 · WordPress · Wp Fastest Cache
Name of the Vulnerable Software and Affected Versions: WP Fastest Cache versions prior to 1.2.2 Description: The issue is related to the WP Fastest Cache WordPress plugin, which does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection...
PT-2023-30515 · Unknown · Oss Calendar
Name of the Vulnerable Software and Affected Versions: OSS Calendar versions prior to 2.0.3 Description: The issue allows a remote authenticated attacker to execute arbitrary code or obtain and/or alter the information stored in the database by sending a specially crafted request. This can be...
CVE-2023-6097: Improper Neutralization of Special Elements used in an SQL Command
A SQL injection vulnerability has been found in ICS Business Manager, affecting version 7.06.0028.7089. This vulnerability could allow a remote user to send a specially crafted SQL query and retrieve all the information stored in the database. The data could also be modified or deleted, causing t...
PYSEC-2023-241
Piccolo is an object-relational mapping and query builder which supports asyncio. Prior to version 1.1.1, the handling of named transaction savepoints in all database implementations is vulnerable to SQL Injection via f-strings. While the likelihood of an end developer exposing a savepoints name...
CVE-2023-47128
Piccolo is an object-relational mapping and query builder which supports asyncio. Prior to version 1.1.1, the handling of named transaction savepoints in all database implementations is vulnerable to SQL Injection via f-strings. While the likelihood of an end developer exposing a savepoints name...
PT-2023-30331 · Piccolo · Piccolo
Name of the Vulnerable Software and Affected Versions: Piccolo versions prior to 1.1.1 Description: The handling of named transaction savepoints in all database implementations is vulnerable to SQL Injection via f-strings. This could allow a malicious user to have direct access to the database an...
CVE-2023-47128: Improper Neutralization of Special Elements used in an SQL Command
Piccolo is an object-relational mapping and query builder which supports asyncio. Prior to version 1.1.1, the handling of named transaction savepoints in all database implementations is vulnerable to SQL Injection via f-strings. While the likelihood of an end developer exposing a savepoints name...
Piccolo Security Breach
Piccolo is Piccolo open source a fast , user-friendly ORM and query builder . Piccolo 1.1.1 before the version has a security vulnerability , the vulnerability stems from the vulnerability to SQL injection attacks , attackers can use the vulnerability to directly access the database...