Database with 1.2 billion people’s data leaked online without password

By Sudais In total, the database was home to over 4 terabytes of data sitting in plain sight for public access. This is a post from HackRead.com Read the original post: Database with 1.2 billion people's data leaked online without password...

Sql injection

An issue was discovered in phpMyAdmin before 4.9.2. A crafted database/table name can be used to trigger a SQL injection attack through the designer feature...

Sql injection

In Progress MOVEit Transfer 10.2 before 10.2.6 2018.3, 11.0 before 11.0.4 2019.0.4, and 11.1 before 11.1.3 2019.1.3, multiple SQL Injection vulnerabilities have been found in the REST API that could allow an unauthenticated attacker to gain unauthorized access to the database. Depending on the...

CVE-2019-18464

CVE-2019-18464 affects Progress MOVEit Transfer REST API across the affected branches: 10.2 before 10.2.6 (2018.3), 11.0 before 11.0.4 (2019.0.4), and 11.1 before 11.1.3 (2019.1.3). The vulnerability is SQL Injection in the REST API that can allow an unauthenticated attacker to gain unauthorized ...

UBUNTU-CVE-2019-2957

Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Security: Encryption. Supported versions that are affected are 8.0.17 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server...

CVE-2019-16383

MOVEit.DMZ.WebApi.dll in Progress MOVEit Transfer 2018 SP2 before 10.2.4, 2019 before 11.0.2, and 2019.1 before 11.1.1 allows an unauthenticated attacker to gain unauthorized access to the database. Depending on the database engine being used MySQL, Microsoft SQL Server, or Azure SQL, an attacker...

CVE-2019-16383

CVE-2019-16383 affects Progress MOVEit Transfer via MOVEit.DMZ.WebApi.dll in MOVEit Transfer 2018 SP2 before 10.2.4, 2019 before 11.0.2, and 2019.1 before 11.1.1. The Red Hat/CIRCL/CNVD entries confirm an unauthenticated SQL injection via the REST API that can cause database access breaches. Affe...

CVE-2019-16177

LimeSurvey prior to 3.17.14 exposes the entire database via browser cache. Affected: LimeSurvey before 3.17.14. Root cause: database content is cached and retrievable from the browser. Impact: potential access to complete data set per the cited advisories. Remediation: upgrade to LimeSurvey 3.17....

Tasking Manager SQL Injection Vulnerability

Tasking Manager is a task management tool for coordinating volunteers and organizations from the OpenStreetMap team. A SQL injection vulnerability exists in Tasking Manager. The vulnerability stems from a lack of validation of externally entered SQL statements in the database-based application. A...

CVE-2019-5633

CVE-2019-5633 concerns insecure storage of sensitive data in Hickory Smart for iOS (Cache.db), enabling potential remote control of locks. Affected: Hickory Smart for iOS, version 01.01.07 and earlier. The connected ThreatPost report notes this CVE alongside related flaws (e.g., 2019-5632, 2019-5...

CVE-2019-4483

IBM Contract Management 10.1.0 through 10.1.3 and IBM Emptoris Spend Analysis 10.1.0 through 10.1.3 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IB...

CVE-2018-14670

Incorrect configuration in deb package in ClickHouse before 1.1.54131 could lead to unauthorized use of the database...

Design/Logic Flaw

Incorrect configuration in deb package in ClickHouse before 1.1.54131 could lead to unauthorized use of the database...

CVE-2018-14670

Summary of CVE-2018-14670 (ClickHouse) : A misconfiguration in the Debian package for ClickHouse prior to version 1.1.54131 could allow unauthorized use of the database. Multiple sources confirm the issue and its remediation: update to version 1.1.54131 or later to resolve the vulnerability. The ...

CVE-2019-0348

SAP BusinessObjects Business Intelligence Platform Web Intelligence, versions 4.1, 4.2, can access database with unencrypted connection, even if the quality of protection should be encrypted...

CVE-2019-0348

CVE-2019-0348 affects SAP BusinessObjects Business Intelligence Platform (Web Intelligence) for versions 4.1 and 4.2. The vulnerability involves accessing the database through an unencrypted connection, despite protection expectations that data be encrypted. The connected Red Hat, CNVD, CVE lists...

CVE-2019-8690

creationtimestamp| type| source ---|---|--- 2019-08-12 00:00:00+00:00| exploited| https://www.exploit-db.com/exploits/47237...

Code injection

Comodo Antivirus versions up to 12.0.0.6810 are vulnerable to Arbitrary File Write due to Cavwp.exe handling of Comodo's Antivirus database. Cavwp.exe loads Comodo antivirus definition database in unsecured global section objects, allowing a local low privileged process to modify this data direct...

U.S. Dept Of Defense: [████████] Boolean SQL Injection (/personnel.php?content=profile&rcnum=*)

In this report, I want to describe a dangerous SQL injection, with the help of which I was able to extract certain data from the database. I used the insights from this report 648222. Using the bug from the aforementioned report, I could find this endpoint and done SQL injection. Steps to reprodu...

CVE-2019-13373

An issue was discovered in the D-Link Central WiFi Manager CWM100 before v1.03R0100BETA6. Input does not get validated and arbitrary SQL statements can be executed in the database via the /web/Public/Conn.php parameter dbSQL...