PT-2021-10574

Name of the Vulnerable Software and Affected Versions: emlog version 6.0.0 Description: The issue is a SQL injection that can be exploited via the /admin/comment.php API endpoint. This allows for potential unauthorized access or manipulation of database content. Recommendations: For emlog version...

Rockwellautomation Rslinx Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Products that use EDS Subsystem: Version 28.0.1 and prior FactoryTalk Linx software Previously called RSLinx Enterprise: Versions 6.00, 6.10, and 6.11, RSLinx Classic: Version 4.11.00 and prior, RSNetWorx software: Version 28.00.00 and prior, Studio 5000 Logix Designer software: Version 32 and...

CVE-2020-4902

IBM Datacap Taskmaster Capture IBM Datacap Navigator 9.1.7 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID: 191045...

SQL Injection in s-cart/core

✍️ Description Searching keyword in/scadmin/currency is vulnerable to SQL injection. This will allow a user to run arbitrary SQL queries and completely delete, edit, export or change all information in the database - potentially rendering the entire platform unusable. 🕵️‍♂️ Proof of Concept Login...

PT-2021-11059

Name of the Vulnerable Software and Affected Versions: Trace Financial CRESTBridge versions prior to 6.3.0.03 Description: The issue concerns an authenticated SQL injection vulnerability. This means that an attacker who has valid credentials can potentially inject malicious SQL code to manipulate...

CVE-2021-28122

A request-validation issue was discovered in Open5GS 2.1.3 through 2.2.x before 2.2.1. The WebUI component allows an unauthenticated user to use a crafted HTTP API request to create, read, update, or delete entries in the subscriber database. For example, new administrative users can be added. Th...

CVE-2021-28122

A request-validation issue was discovered in Open5GS 2.1.3 through 2.2.x before 2.2.1. The WebUI component allows an unauthenticated user to use a crafted HTTP API request to create, read, update, or delete entries in the subscriber database. For example, new administrative users can be added. Th...

Sql injection

A remote authenticated SQL Injection vulnerabilitiy was discovered in Aruba ClearPass Policy Manager versions: Prior to 6.9.5, 6.8.8-HF1, 6.7.14-HF1. A vulnerability in the web-based management interface API of ClearPass could allow an authenticated remote attacker to conduct SQL injection attack...

ZOHO ManageEngine Applications Manager SQL注入漏洞

ZOHO ManageEngine Applications Manager is a suite of IT operations management solutions from ZOHO USA. A security vulnerability exists in ZOHO ManageEngine Applications Manager Alarmview, which can be exploited by remote attackers to submit a special SQL request to manipulate the database, obtain...

CVE-2020-4655: Improper Neutralization of Special Elements used in an SQL Command

IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.0.3.2 and 5.2.0.0 through 5.2.6.5 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM...

PT-2020-18182

Name of the Vulnerable Software and Affected Versions IBM Sterling File Gateway versions 2.2.0.0 through 2.2.6.5 IBM Sterling File Gateway versions 6.0.0.0 through 6.0.3.2 Description The issue allows a remote attacker to send specially crafted SQL statements, which could enable the attacker to...

CVE-2020-4647

IBM Sterling File Gateway 2.2.0.0 through 2.2.6.5 and 6.0.0.0 through 6.0.3.2 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database...

PT-2020-11015

Name of the Vulnerable Software and Affected Versions IBM Maximo Asset Management versions 7.6.0 through 7.6.1 Description The issue allows a remote attacker to send specially-crafted SQL statements, potentially enabling them to view, add, modify, or delete information in the back-end database...

F5 BIG-IP AFM Configuration Tool SQL Injection Vulnerability

The F5 BIG-IP AFM is an advanced firewall device. The F5 BIG-IP AFM configuration tool suffers from a sql injection vulnerability that can be exploited by remote attackers to submit a special SQL request to manipulate a database, which can be used to obtain sensitive information or execute...

CVE-2020-15099

In TYPO3 CMS greater than or equal to 9.0.0 and less than 9.5.20, and greater than or equal to 10.0.0 and less than 10.4.6, in a case where an attacker manages to generate a valid cryptographic message authentication code HMAC-SHA1 - either by using a different existing vulnerability or in case t...

Remote code execution

In TYPO3 CMS greater than or equal to 9.0.0 and less than 9.5.20, and greater than or equal to 10.0.0 and less than 10.4.6, in a case where an attacker manages to generate a valid cryptographic message authentication code HMAC-SHA1 - either by using a different existing vulnerability or in case t...

GHSA-3X94-FV5H-5Q2C Exposure of Sensitive Information to an Unauthorized Actor in TYPO3 CMS

Meta CVSS: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C 7.5 CWE-20, CWE-200 Problem In case an attacker manages to generate a valid cryptographic message authentication code HMAC-SHA1 - either by using a different existing vulnerability or in case the internal encryptionKey was...

CVE-2020-15099

CVE-2020-15099 affects TYPO3 CMS versions 9.0.0–9.5.19 and 10.0.0–10.4.5. An attacker who can construct a valid HMAC-SHA1 can access arbitrary files (e.g., typo3conf/LocalConfiguration.php) containing the encryptionKey and DB credentials, enabling full DB access and potentially creating an admin ...

Sql injection

rConfig 3.9.5 is vulnerable to SQL injection. A remote authenticated attacker could send crafted SQL statements to the devices.php script using the sortBy parameter, which could allow the attacker to view, add, modify, or delete information in the back-end database...

CVE-2020-15714

rConfig 3.9.5 is vulnerable to SQL injection. A remote authenticated attacker could send crafted SQL statements to the devices.crud.php script using the customLocation parameter, which could allow the attacker to view, add, modify, or delete information in the back-end database...