Pimcore vulnerable to disclosure of system and database information behind /admin firewall

Summary Navigating to /admin/index/statistics with a logged in Pimcore user not an XmlHttpRequest because of this check: IndexController:125 exposes information about the Pimcore installation, PHP version, MYSQL version, installed bundles and all database tables and their row count in the system...

CVE-2024-41109 Pimcore vulnerable to disclosure of system and database information behind /admin firewall

Pimcore's Admin Classic Bundle provides a backend user interface for Pimcore. Navigating to /admin/index/statistics with a logged in Pimcore user exposes information about the Pimcore installation, PHP version, MYSQL version, installed bundles and all database tables and their row count in the...

CVE-2024-39027

SeaCMS v12.9 has an unauthorized SQL injection vulnerability. The vulnerability is caused by the SQL injection through the cid parameter at /js/player/dmplayer/dmku/index.php?ac=edit, which can cause sensitive database information to be leaked...

CVE-2024-39027

SeaCMS v12.9 has an unauthorized SQL injection vulnerability. The vulnerability is caused by the SQL injection through the cid parameter at /js/player/dmplayer/dmku/index.php?ac=edit, which can cause sensitive database information to be leaked...

TotalCloud Insights: Protect Your AWS Environment by Managing Access Keys Securely

Introduction With the average cost of a data breach coming in at $4.45M in 2023, safeguarding sensitive information and maintaining the security of cloud environments is more critical than ever. Instances of compromised access keys, not exclusive to AWS Amazon Web Services but prevalent across...

SQL Injection Vulnerability in UFIDA NC of UFIDA Network Technology Co. Ltd (CNVD-2024-31573)

UFIDA NC is a large erp enterprise management system and e-commerce platform. A SQL injection vulnerability exists in UFIDA NC, which can be exploited by attackers to obtain sensitive database information...

SQL Injection Vulnerability in UFIDA NC of UFIDA Network Technology Co. Ltd (CNVD-2024-30550)

UFIDA NC is a large erp enterprise management system and e-commerce platform. A SQL injection vulnerability exists in UFIDA NC, which can be exploited by attackers to obtain sensitive database information...

Qingdao Aimi Cloud Software Co., Ltd. yueku enterprise network disk SQL injection vulnerability

Founded in 2015, Qingdao AmiCloud Software Co., Ltd. is a professional enterprise document management company, dedicated to enterprise document management web disk related technology research and development, resource integration, product promotion, project application and so on. Qingdao Aimi Clo...

SQL Injection Vulnerability in UFIDA NC of UFIDA Network Technology Co. Ltd (CNVD-2024-28042)

UFIDA NC is a large erp enterprise management system and e-commerce platform. A SQL injection vulnerability exists in UFIDA NC, which can be exploited by attackers to obtain sensitive database information...

SQL Injection Vulnerability in springblade Framework of Shanghai Breadtech Co.

Ltd. is a software technology-oriented enterprise with high-end software technology consulting and microservice technology architecture design as its main business. Ltd springblade framework has a SQL injection vulnerability that can be exploited by attackers to obtain sensitive database...

CVE-2024-35548

A SQL injection vulnerability in Mybatis plus versions below 3.5.6 allows remote attackers to obtain database information via a Boolean blind injection. NOTE: the vendor's position is that this can only occur in a misconfigured application; the documentation discusses how to develop applications...

CVE-2024-35548

A SQL injection vulnerability in Mybatis plus versions below 3.5.6 allows remote attackers to obtain database information via a Boolean blind injection. NOTE: the vendor's position is that this can only occur in a misconfigured application; the documentation discusses how to develop applications...

CVE-2024-35548

A SQL injection vulnerability in Mybatis plus versions below 3.5.6 allows remote attackers to obtain database information via a Boolean blind injection. NOTE: the vendor's position is that this can only occur in a misconfigured application; the documentation discusses how to develop applications...

CVE-2024-35548

A SQL injection vulnerability in Mybatis plus versions below 3.5.6 allows remote attackers to obtain database information via a Boolean blind injection. NOTE: the vendor's position is that this can only occur in a misconfigured application; the documentation discusses how to develop applications...

MyBatis-Plus 安全漏洞

MyBatis-Plus is an open source toolkit from Baomidou. A security vulnerability exists in MyBatis-Plus versions prior to 3.5.6, which stems from the presence of a SQL injection vulnerability. An attacker can exploit the vulnerability to obtain database information via Boolean blind injection...

SQL Injection Vulnerability in Kotto's Fully Intelligent Parking Video Charging System (CNVD-2024-25885)

Xiamen KTO Communication Technology Co., Ltd. is a professional intelligent parking value operator. A SQL injection vulnerability exists in KETO's fully intelligent parking video charging system, which can be exploited by an attacker to obtain sensitive information from the database...

SQL Injection Vulnerability in Data Leakage Protection (DLP) System of Beijing Yisetong Technology Development Co., Ltd (CNVD-C-2024-272015)

Yisetong Data Leakage Protection DLP is a comprehensive data security product that integrates machine learning, big data analysis, document encryption, access control, correlation analysis, data identification and other technologies. Data Leakage Protection DLP system of Beijing Yisetong Technolo...

SQL Injection Vulnerability in Ruiyou Tianyi Application Virtualization System of Xi'an Ruiyou Information Technology Information Co. Ltd (CNVD-2024-23827)

Ruiyou Tianyi Application Virtualization System is a domestic application virtualization platform with independent intellectual property rights, which is based on Server-based Computing. Xi'an Ruiyou Information Technology Co., Ltd. Ruiyou Tianyi Application Virtualization System suffers from a S...

SQL Injection Vulnerability in SpringBlade of Shanghai Breadtech Co.

SpringBlade is a microservice architecture upgraded and optimized from a commercial-grade project, built with core technologies such as Spring Boot 2.5 and Spring Cloud 2020, and fully following Alibaba coding standards. Ltd. SpringBlade exists SQL injection vulnerability, attackers can use the...

SQL Injection Vulnerability in Ruiyou Skywing Application Virtualization System of Xi'an Ruiyou Information Technology Information Co. Ltd (CNVD-2024-22511)

Ruiyou Tianyi Application Virtualization System is a domestic application virtualization platform with independent intellectual property rights, which is based on Server-based Computing. Xi'an Ruiyou Information Technology Co., Ltd. Ruiyou Tianyi Application Virtualization System suffers from a S...