97 matches found
GHSA-38FC-9XQV-7F7Q SQLAlchemy is vulnerable to SQL Injection via group_by parameter
SQLAlchemy 1.2.17 has SQL Injection when the groupby parameter can be controlled...
openSUSE Security Update : python-Django (openSUSE-2019-614)
This update for python-Django to version 2.08 fixes the following issues : The following security vulnerability was fixed : - CVE-2018-14574: Fixed an redirection vulnerability in CommonMiddleware boo1102680 The following other bugs were fixed : - Fixed a regression in Django 2.0.7 that broke the...
DEBIAN-CVE-2019-7548
SQLAlchemy 1.2.17 has SQL Injection when the groupby parameter can be controlled...
PYSEC-2019-124
SQLAlchemy 1.2.17 has SQL Injection when the groupby parameter can be controlled...
PYSEC-2019-124
SQLAlchemy 1.2.17 has SQL Injection when the groupby parameter can be controlled...
UBUNTU-CVE-2019-7548
SQLAlchemy 1.2.17 has SQL Injection when the groupby parameter can be controlled...
PYSEC-2019-54
SQLAlchemy 1.2.17 has SQL Injection when the groupby parameter can be controlled...
ResourceSpace 8.6 - 'collection_edit.php' SQL Injection
Exploit Title: ResourceSpace &redirect=yes&ref=3620&submitted=true&name=PWNED&keywords=©=&save=%C2%A0%C2%A0Save%C2%A0%C2%A0'...
Medium: php-ZendFramework
Issue Overview: The implementation of ORDER BY and GROUP BY in ZendDbSelect was discovered to be vulnerable to SQL injection. Affected Packages: php-ZendFramework Issue Correction: Run yum update php-ZendFramework or yum update --advisory ALAS-2016-767 to update your system. New Packages: noarch:...
Oracle MySQL 5.7.x < 5.7.13 Multiple Vulnerabilities
Binary data 9616.prm...
Zend Framework vulnerable to SQL injection
Overview Zend Framework is an open source web application framework. Zend Framework 1 contains an SQL injection vulnerability CWE-89 due to a flaw in processing parameters in the ORDER BY and GROUP BY clauses. Hiroshi Tokumaru of HASH Consulting Corp. reported this vulnerability to IPA. JPCERT/CC...
Updated php-ZendFramework packages fix security vulnerability
The implementation of ORDER BY and GROUP BY in ZendDbSelect of ZendFramework is vulnerable to an SQL injection CVE-2016-6233...
MariaDB多个拒绝服务漏洞
MariaDB基于事务的Maria存储引擎，替换了MySQL的MyISAM存储引擎，它使用了Percona的 XtraDB，InnoDB的变体，分支的开发者希望提供访问即将到来的MySQL 5.4 InnoDB性能。 1），当处理某些编写有子查询的SELECT语句时的空指针引用错误，可以被利用来导致系统崩溃。 成功利用此漏洞，需要在"materialization"和"semijoin"优化切换到打开时。 2） 处理有某些并发的SQL查询的KILL查询语句时的错误，可被利用来导致系统崩溃。 3）分析NAMECONST表达式时包含AND/OR表达式，可以被利用来导致系统崩溃。...
MariaDB Server 5.5.x < 5.5.36 Remote Multiple Denial of Service Vulnerabilities
Binary data 8132.prm...
MySQL: crash with user variables, assignments, joins... (MySQL Bug #55564)
MySQL 5.1 before 5.1.51 and 5.5 before 5.5.6 allows remote authenticated users to cause a denial of service mysqld server crash by performing a user-variable assignment in a logical expression that is calculated and stored in a temporary table for GROUP BY, then causing the expression value to be...
CVE-2010-3835: Undefined Security Weakness
MySQL 5.1 before 5.1.51 and 5.5 before 5.5.6 allows remote authenticated users to cause a denial of service mysqld server crash by performing a user-variable assignment in a logical expression that is calculated and stored in a temporary table for GROUP BY, then causing the expression value to be...
MySQL: crash with user variables, assignments, joins... (MySQL Bug #55564)
MySQL 5.1 before 5.1.51 and 5.5 before 5.5.6 allows remote authenticated users to cause a denial of service mysqld server crash by performing a user-variable assignment in a logical expression that is calculated and stored in a temporary table for GROUP BY, then causing the expression value to be...