CVE-2020-8967

CVE-2020-8967 | GESIO ERP SQL injection : The vulnerability is in PHP files of GESIO ERP, with an improper Neutralization of Special Elements used in SQL commands. All versions prior to 11.2 are affected and allow a malicious user to retrieve database information. Evidence from multiple sources c...

CVE-2020-3184 Cisco Prime Collaboration Provisioning Software SQL Injection Vulnerability

A vulnerability in the web-based management interface of Cisco Prime Collaboration Provisioning Software could allow an authenticated, remote attacker to conduct SQL injection attacks on an affected system. The vulnerability exists because the web-based management interface improperly validates...

Extreme cms suffers from SQL injection vulnerability (CNVD-2020-30189)

Extreme CMS is an open source and free PHPCMS web content management system. Extreme CMS has SQL injection vulnerability , attackers can exploit the vulnerability to obtain database sensitive information...

CVE-2020-5248

GLPI before before version 9.4.6 has a vulnerability involving a default encryption key. GLPIKEY is public and is used on every instance. This means anyone can decrypt sensitive data stored using this key. It is possible to change the key before installing GLPI. But on existing instances, data mu...

Nextcloud: External storage app saves password for all users in the database

External storage filesexternal app save passwords of all users to database table "occredentials" even when "Log-in credentials, save in database" option is not used. It's a security risk that allow password extraction of all users. A local system admin that has access to database and nextcloud...

CVE-2020-12458

Grafana CVE-2020-12458: An information-disclosure flaw exists through Grafana 6.7.3 where the database directory /var/lib/grafana and /var/lib/grafana/grafana.db are world-readable, potentially exposing sensitive datasource passwords. Public advisories (e.g., ALINUX3-SA-2021:0073, RHSA/CESA entri...

ZSQL: Check for users and roles with DBA role

The DBA role has all system permissions. Therefore, use this role only when absolutely necessary. You are advised to use a user not inheriting the DBA role to connect to the database. SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, an...

Arbitrary Code Execution

perl-dbd-pg is vulnerable to arbitrary code execution. A heap-based buffer overflow flaw was discovered in the perl-DBD-Pg pggetline function implementation. If the pggetline or getline functions read large, untrusted records from a database, it could cause an application using these functions to...

CVE-2020-11592

An issue was discovered in CIPPlanner CIPAce 9.1 Build 2019092801. An unauthenticated attacker can make an API request and get the columns of a specific table within the CIP database...

Sentrifugo HRMS 3.2 SQL Injection

Exploit Title: Sentrifugo HRMS 3.2 - 'id' SQL Injection Exploit Author: minhnb Website: Date: 2020-03-06 Google Dork: N/A Vendor: http://www.sapplica.com Software Link: http://www.sentrifugo.com/download Affected Version: 3.2 and possibly before Patched Version: unpatched Category: Web Applicatio...

SQL Injection

django is vulnerable to SQL injection. Lack of adequate validation and sanitization of the tolerance parameter allows an attacker to inject and execute arbitrary SQL statements in the database...

CVE-2019-19608

A SQL injection vulnerability in in the web conferencing component of Mitel MiCollab AWV before 8.1.2.2 could allow an unauthenticated attack due to insufficient input validation for the registeredList.cgi page. A successful exploit could allow an attacker to extract sensitive information from th...

phpMyChat-Plus SQL Injection Vulnerability

phpMyChat-Plus is a chat room system based on PHP and MySQL. A SQL injection vulnerability exists in phpMyChat-Plus version 1.98. The vulnerability stems from a lack of validation of externally entered SQL statements in database-based applications. An attacker can exploit this vulnerability to...

CVE-2020-8611

In Progress MOVEit Transfer 2019.1 before 2019.1.4 and 2019.2 before 2019.2.1, multiple SQL Injection vulnerabilities have been found in the REST API that could allow an authenticated attacker to gain unauthorized access to MOVEit Transfer's database via the REST API. Depending on the database...

CVE-2020-8611

CVE-2020-8611 reports multiple SQL injection vulnerabilities in the REST API of MOVEit Transfer (versions 2019.1 prior to 2019.1.4 and 2019.2 prior to 2019.2.1). An authenticated attacker could gain unauthorized access to MOVEit Transfer’s database via the REST API, and depending on the database ...

CVE-2020-3937

The CVE-2020-3937 entry concerns a SQL injection vulnerability in SysJust Syuan-Gu-Da-Shih for versions before 20191223. The underlying issue is unsafely constructed SQL queries that allow an attacker to perform arbitrary SQL queries and access arbitrary files within the database. Impact details ...

CVE-2014-5140

CVE-2014-5140 affects Loaded Commerce 7. The vulnerability is in the bindReplace function of the query factory (includes/classes/database.php), which does not properly handle colon characters. This enables SQL injection via the First name and Last name fields in the address book when used by remo...

CVE-2019-19732

translationmanagetext.ajax.php and various manage.ajax.php in MFScripts YetiShare 3.5.2 through 4.5.3 directly insert values from the aSortDir0 and/or sSortDir0 parameter into a SQL string. This allows an attacker to inject their own SQL and manipulate the query, typically extracting data from th...

U.S. Dept Of Defense: Leaked DB credentials on https://██████████.mil/███

Summary: Information disclosure with login credentials for ms-sql database exposed. Description: I've found a PHP info file disclosed on https://█████.mil/██████ containing login credentials for a database cloud server ███████ as well as information on the host system such as hostname, username a...

SQL Server 2019 Security Tool Inadvertently Reveals Where Sensitive Data is Stored

The first step in protecting your data and ensuring your database is compliant with security benchmarks and privacy regulations such as SOX, PCI, HIPAA, and GDPR is to understand what sensitive information resides in that database. Microsoft’s SQL Server 2019 introduces a new tool SQL Data...