EUVD-2022-4471

Malicious code in bioql PyPI...

com.fizzed:ninja-undertow (5.4.0.undertow1), com.markvink:mangooio-elasticsearch-extension (>=1.0.0, <=1.1.0) +14 more potentially affected by CVE-2023-1973 via io.undertow:undertow-core (1.3.18.final)

io.undertow:undertow-core MAVEN version 1.3.18.final is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - com.fizzed:ninja-undertow 5.4.0.undertow1 - com.markvink:mangooio-elasticsearch-extension =1.0.0,...

Yii Framework Code Injection

Yii 2.x before 2.0.15 allows remote attackers to inject unintended search conditions via a variant of the CVE-2018-7269 attack in conjunction with the Elasticsearch extension...

Design/Logic Flaw

Yii 2.x before 2.0.15 allows remote attackers to inject unintended search conditions via a variant of the CVE-2018-7269 attack in conjunction with the Elasticsearch extension...

CVE-2018-8074

Yii 2.x before 2.0.15 allows remote attackers to inject unintended search conditions via a variant of the CVE-2018-7269 attack in conjunction with the Elasticsearch extension...

CVE-2018-8074

The CVE-2018-8074 entry affects Yii 2.x before 2.0.15. The vulnerability is in framework/db/ActiveRecord.php (findByCondition) where remote attackers can inject unintended SQL conditions via findOne()/findAll(), often in conjunction with the Elasticsearch extension. This is a SQL injection in the...

PT-2018-18420

Name of the Vulnerable Software and Affected Versions: Yii versions prior to 2.0.15 Description: The issue allows remote attackers to inject unintended search conditions via a variant of an attack in conjunction with the Elasticsearch extension. Recommendations: For versions prior to 2.0.15, upda...

CVE-2018-8074: Improper Control of Generation of Code

Yii 2.x before 2.0.15 allows remote attackers to inject unintended search conditions via a variant of the CVE-2018-7269 attack in conjunction with the Elasticsearch extension...