CVE-2023-0620

HashiCorp Vault/Vault Enterprise versions 0.8.0–1.13.1 are vulnerable to SQL injection when configuring the Microsoft SQL (MSSQL) Database Storage Backend. In the MSSQL plugin configuration, certain parameters are not sanitized before being passed to the backend, allowing a local attacker to modi...

CVE-2023-0620

HashiCorp Vault and Vault Enterprise versions 0.8.0 through 1.13.1 are vulnerable to an SQL injection attack when configuring the Microsoft SQL MSSQL Database Storage Backend. When configuring the MSSQL plugin through the local, certain parameters are not sanitized when passed to the user-provide...

CVE-2023-0620 Vault Vulnerable to SQL Injection When Configuring the Microsoft SQL Database Storage Backend

HashiCorp Vault and Vault Enterprise versions 0.8.0 through 1.13.1 are vulnerable to an SQL injection attack when configuring the Microsoft SQL MSSQL Database Storage Backend. When configuring the MSSQL plugin through the local, certain parameters are not sanitized when passed to the user-provide...

CVE-2023-0620: Improper Neutralization of Special Elements used in an SQL Command

HashiCorp Vault and Vault Enterprise versions 0.8.0 through 1.13.1 are vulnerable to an SQL injection attack when configuring the Microsoft SQL MSSQL Database Storage Backend. When configuring the MSSQL plugin through the local, certain parameters are not sanitized when passed to the user-provide...

PT-2023-8746 · Microsoft +2 · Sql +3

Name of the Vulnerable Software and Affected Versions: HashiCorp Vault and Vault Enterprise versions 0.8.0 through 1.13.1 Description: The issue is related to an SQL injection attack when configuring the Microsoft SQL MSSQL Database Storage Backend. Certain parameters are not sanitized when passe...

CVE-2023-1574

Information disclosure in the user creation feature of a MSSQL data source in Devolutions Remote Desktop Manager 2023.1.9 and below on Windows allows an attacker with access to the user interface to obtain sensitive information via the error message dialog that displays the password in clear text...

CVE-2023-1574

Information disclosure in the user creation feature of a MSSQL data source in Devolutions Remote Desktop Manager 2023.1.9 and below on Windows allows an attacker with access to the user interface to obtain sensitive information via the error message dialog that displays the password in clear text...

CVE-2023-1574

Devolutions Remote Desktop Manager ≤ 2023.1.9 (Windows) has an information-disclosure flaw in the MSSQL user-creation feature: the error dialog reveals the password in clear text when UI access is available. Impact is confidential data exposure with low user interaction, no exploitation vector be...

CVE-2023-1574: Insufficiently Protected Credentials

Information disclosure in the user creation feature of a MSSQL data source in Devolutions Remote Desktop Manager 2023.1.9 and below on Windows allows an attacker with access to the user interface to obtain sensitive information via the error message dialog that displays the password in clear text...

PT-2023-17090 · Devolutions · Devolutions Remote Desktop Manager

Name of the Vulnerable Software and Affected Versions: Devolutions Remote Desktop Manager versions 2023.1.9 and below Description: The issue concerns information disclosure in the user creation feature of a MSSQL data source. An attacker with access to the user interface can obtain sensitive...

Exploit for Improper Access Control in Joomla Joomla\!

CVE-2023-23752 Joomla unauthorized access vulnerability CVE...

CVE-2022-44015

An issue was discovered in Simmeth Lieferantenmanager before 5.6. An attacker can inject raw SQL queries. By activating MSSQL features, the attacker is able to execute arbitrary commands on the MSSQL server via the xpcmdshell extended procedure...

Design/Logic Flaw

An issue was discovered in Simmeth Lieferantenmanager before 5.6. In the design of the API, a user is inherently able to fetch arbitrary SQL tables. This leaks all user passwords and MSSQL hashes via /DS/LMAPI/api/SelectionService/GetPaggedTab...

Sql injection

An issue was discovered in Simmeth Lieferantenmanager before 5.6. An attacker can inject raw SQL queries. By activating MSSQL features, the attacker is able to execute arbitrary commands on the MSSQL server via the xpcmdshell extended procedure...

PT-2022-27078 · Microsoft · Mssql

Name of the Vulnerable Software and Affected Versions: Simmeth Lieferantenmanager versions prior to 5.6 Description: An issue was discovered that allows an attacker to inject raw SQL queries. By activating MSSQL features, the attacker can execute arbitrary commands on the MSSQL server via the xp...

CVE-2022-44015

An issue was discovered in Simmeth Lieferantenmanager before 5.6. An attacker can inject raw SQL queries. By activating MSSQL features, the attacker is able to execute arbitrary commands on the MSSQL server via the xpcmdshell extended procedure...

CVE-2022-44015: Improper Neutralization of Special Elements used in an SQL Command

An issue was discovered in Simmeth Lieferantenmanager before 5.6. An attacker can inject raw SQL queries. By activating MSSQL features, the attacker is able to execute arbitrary commands on the MSSQL server via the xpcmdshell extended procedure...

CVE-2022-44014: Improper Access Control

An issue was discovered in Simmeth Lieferantenmanager before 5.6. In the design of the API, a user is inherently able to fetch arbitrary SQL tables. This leaks all user passwords and MSSQL hashes via /DS/LMAPI/api/SelectionService/GetPaggedTab...

CVE-2022-44015

An issue was discovered in Simmeth Lieferantenmanager before 5.6. An attacker can inject raw SQL queries. By activating MSSQL features, the attacker is able to execute arbitrary commands on the MSSQL server via the xpcmdshell extended procedure...

CVE-2022-44015

CVE-2022-44015 affects the Simmeth Lieferantenmanager (Simmeth System GmbH) prior to version 5.6. The issue is a SQL injection vulnerability that allows an attacker to inject raw SQL queries. By activating MSSQL features, the attacker can execute arbitrary commands on the MSSQL server using the x...