Aruba ClearPass Policy Manager SQL注入漏洞

Aruba ClearPass Policy Manager is an application from Aruba, Inc. that provides a wireless network security access management system. Aruba ClearPass Policy Manager has a security vulnerability that could allow a remote attacker to perform a SQL injection attack on a ClearPass instance...

hibernate-core: SQL injection vulnerability when both hibernate.use_sql_comments and JPQL String literals are used

A flaw was found in hibernate-core in versions prior to and including 5.4.23.Final. A SQL injection in the implementation of the JPA Criteria API can permit unsanitized literals when a literal is used in the SQL comments of the query. This flaw could allow an attacker to access unauthorized...

IBM Security Verify 注入漏洞

IBM Security Verify Privilege Vault is a privileged access management solution that enables IT administrators and IT security professionals to protect the privileges of all services, applications, roots and administrator accounts across the enterprise. A link injection vulnerability exists in IBM...

Moldeo WebPort SQL注入漏洞

Philips Tasy WebPortal is a Web-based portal system from Philips Europe Philips. A code injection vulnerability exists in WebPort, which stems from WebPort version 1.19.1 and earlier versions that can be exploited by an attacker to gain control of the server...

Hitachi Virtual File Platform 操作系统命令注入漏洞

Hitachi Virtual File Platform is a virtual file platform from Hitachi, Japan. Hitachi Virtual File Platform suffers from an operating system command injection vulnerability that stems from incorrect input validation. A remotely authenticated attacker could pass specially crafted data to the...

SUSE: Security Advisory (SUSE-SU-2018:3988-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Radsecproxy 注入漏洞

Radsecproxy is a general-purpose RADIUS proxy that supports both UDP and TLS RadSec RADIUS transports. An injection vulnerability exists in Radsecproxy versions prior to 1.9, which stems from a lack of input validation in the naptr-eduroam.sh and radsec-dynsrv.sh scripts, and could lead to...

resteasy: Improper validation of response header in MediaTypeHeaderDelegate.java class

A flaw was found in Resteasy, where an improper input validation results in returning an illegal header that integrates into the server's response. This flaw may result in an injection, which leads to unexpected behavior when the HTTP response is constructed...

CVE-2021-3529

A flaw was found in noobaa-core. This flaw results in the name of an arbitrary URL copied into an HTML document as plain text between tags, including a potential payload script. The input is echoed unmodified in the application response, resulting in arbitrary JavaScript being injected into an...

phpGACL SQL注入漏洞

phpGACL is an open source PHP class for Web developers to provide a simple but powerful "insert" permission system . For its current Web-based applications to use . Phpgacl version 3.3.7 SQL injection vulnerability , the vulnerability stems from the program admin/edit group.php page SQL injection...

Cisco Unified Communications Manager和Cisco Unity Connection 代码注入漏洞

Cisco Unity Connection UC and Cisco Unified Communications Manager CUCM, Unified CM, CallManager are both products of Cisco Corporation.Cisco Unity Connection is a voice Cisco Unity Connection is a voice messaging platform. The platform can use voice commands to make calls or listen to messages i...

vscode-stripe 注入漏洞

gracegoo-stripe vscode-stripe is an open source application plugin for gracegoo-stripe.Stripe's extensions to Visual Studio Code make it easy to generate sample code, view API request logs, forward events to your application, and use Stripe in the editor. vscode-stripe has an injection...

Aruba Networks AirWave Management Platform SQL注入漏洞

Aruba Networks AirWave Management Platform is a suite of network management software for multi-vendor management from Aruba Networks. The software provides real-time monitoring, proactive alerting and historical data reporting. An SQL injection vulnerability exists in the API of Aruba Networks...

Matthias Van Woensel qcubed SQL注入漏洞

Matthias Van Woensel qcubed is an application by Matthias Van Woensel. It provides a PHP model-view-controller framework for rapid application development. A SQL injection vulnerability exists in qcubed all versions including 3.1.1, which allows unauthenticated access to a database via injection ...

Security Bulletin: Vulnerabilities in Node.js and FasterXML jackson-databind affect IBM Spectrum Protect Plus

Summary Multiple vulnerabilities in Node.js and FasterXML jackson-databind may affect IBM Spectrum Protect Plus. Vulnerability Details CVEID: CVE-2020-25649 DESCRIPTION: FasterXML Jackson Databind could provide weaker than expected security, caused by not having entity expansion secured properly....

CVE-2020-12148

A command injection flaw identified in the nslookup API in Silver Peak Unity ECOSTM ECOS appliance software could allow an attacker to execute arbitrary commands with the privileges of the web server running on the EdgeConnect appliance. An attacker could exploit this vulnerability to establish a...

SQL Injection Vulnerability in Toonhill Studio's Website Building System

Toonhoe Studios is an internet solution provider and website development company. A SQL injection vulnerability exists in the Toonhide Studio website builder system, which can be exploited by attackers to obtain database information...

Design/Logic Flaw

An issue was discovered in B&R Industrial Automation APROL before R4.2 V7.08. Some web scripts in the web interface allowed injection and execution of arbitrary unintended commands on the web server, a different vulnerability than CVE-2019-16364...

IBM Cloud Pak for Security 注入漏洞

IBM Cloud Pak System is a full-stack, converged infrastructure with configurable, pre-integrated software from IBM USA. The product supports deploying, managing and moving application environments across hybrid clouds. An injection vulnerability exists in IBM Cloud Pak for Security, which is caus...

ProcessMaker SQL注入漏洞

Processmaker is the United States Processmaker company a Php written for business process management BPM and workflow management of the building system. ProcessMaker version 3.4.11 suffers from SQL injection vulnerabilities that stem from the program failing to properly validate user input, which...