CVE-2018-20805

CVE-2018-20805 affects MongoDB Server; denial-of-service can be triggered by specially crafted queries using $elemMatch. Impacted are MongoDB Server v4.0 < 4.0.5 and v3.6

CVE-2018-20805 Invariant with $elemMatch

A user authorized to perform database queries may trigger denial of service by issuing specially crafted queries, which perform an $elemMatch . This issue affects MongoDB Server v4.0 versions prior to 4.0.5 and MongoDB Server v3.6 versions prior to 3.6.10...

CVE-2018-20802

CVE-2018-20802 affects MongoDB Server: v3.6 versions before 3.6.9 and v4.0 versions before 4.0.3. A user authorized to perform database queries can trigger a denial of service by issuing specially crafted queries with compound indexes that affect the QueryPlanner. The available documents confirm ...

CVE-2020-7926

CVE-2020-7926 affects MongoDB Server 4.4.x prior to 4.4.1. A user authorized to perform database queries can cause a denial of service by issuing a specially crafted query that violates an invariant in the server selection subsystem. Impact is a partial availability loss (DoS) as described in CVS...

GaussDB Kernel: Controlling Roles with the WITH GRANT OPTION Permission

Users with the WITH GRANT OPTION permission can grant permissions on objects to other users. For database security purposes, control users having this permission. During permission granting, users with the WITH GRANT OPTION permission specify the objects and users with the WITH ADMIN OPTION...

GaussDB Kernel: PUBLIC Role Should Not Have Permissions on All Objects

All users are attached to the PUBLIC role. Therefore, this role should have the fewest permissions for database security purposes. Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

GaussDB Kernel: Configuring the Port

To prevent unauthorized connections to the database and illegal operations on data, you need to change the default port number in time. Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

GaussDB Kernel: Configuring the Password Complexity Check

For database security purposes, password complexity is checked during user creation and password changes. Passwords not meeting complexity requirements are not allowed in GaussDB Kernel. Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources,...

CVE-2020-25694

A flaw was found in PostgreSQL versions before 13.1, before 12.5, before 11.10, before 10.15, before 9.6.20 and before 9.5.24. If a client application that creates additional database connections only reuses the basic connection parameters while dropping security-relevant parameters, an opportuni...

openGauss: Enabling the Auditing of Database Login and Logout

The parameter auditloginlogout specifies whether to audit user login and logout. After this parameter is set to on, users logged in to the database and the time when they logged out are traced. Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced...

openGauss: Revoking the CREATE Permission from a User with the PUBLIC Role

A common user can create malicious functions with the same names as system functions if the user has the PUBLIC role. In this way, other users can call these malicious functions by mistake to compromise database security. If the PUBLIC role has the CREATE permission, any user having this role can...

openGauss: Configuring the Password Complexity Check

For database security purposes, password complexity is checked during user creation and password changes. Passwords not meeting complexity requirements are not allowed in openGauss. Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and a...

openGauss: Controlling Roles with the WITH GRANT OPTION Permission

Users with the WITH GRANT OPTION permission can grant permissions on objects to other users. For database security purposes, control users having this permission. During permission granting, users with the WITH GRANT OPTION permission specify the objects and users with the WITH ADMIN OPTION...

GBase 8s database suffers from a boost vulnerability (CNVD-2020-65128)

GBase 8s is a secure database management system with full intellectual property rights. GBase 8s database suffers from a power lifting vulnerability, which can be exploited by attackers to gain root privileges via symbolic link attack...

Sql injection

A SQL injection vulnerability exists in Victor CMS V1.0 in the catid parameter of the category.php file. This parameter can be used by sqlmap to obtain data information in the database...

CVE-2020-23945

A SQL injection vulnerability exists in Victor CMS V1.0 in the catid parameter of the category.php file. This parameter can be used by sqlmap to obtain data information in the database...

Oracle MySQL Server Server: Security: LDAP Auth Access Control Vulnerability

Oracle MySQL Server is a relational database from Oracle Corporation. Oracle MySQL Server Server: Security: LDAP Auth An access control vulnerability exists in versions 5.7.31 and earlier, 8.0.21 and earlier, which allows an attacker to compromise MySQL Server by accessing the network over multip...

Security Bulletin: Apache Derby as used by IBM QRadar SIEM is vulnerable to Improper Input Validation (CVE-2018-1313)

Summary Apache Derby as used by IBM QRadar SIEM is vulnerable to Improper Input Validation. Vulnerability Details CVEID: CVE-2018-1313 DESCRIPTION: Apache Derby could allow a remote attacker to bypass security restrictions, caused by improper validation of network packets received. By sending a...

Restaurant Reservation System 1.0 SQL Injection

Exploit Title: Restaurant Reservation System 1.0 - 'date' SQL Injection Authenticated Date: 2020-10-05 Exploit Author: b1nary Vendor Homepage: https://www.sourcecodester.com/php/14482/restaurant-reservation-system-php-full-source-code-2020.html Software Link:...

Sql injection

Projectworlds Visitor Management System in PHP 1.0 allows SQL Injection. The file front.php does not perform input validation on the 'rid' parameter. An attacker can append SQL queries to the input to extract sensitive information from the database...