522 matches found
What's the Value of a Key-Value Store?
A database back end for your application is vital, and odds are that your database is a relational database or a "not only SQL" NoSQL database. Relational databases have dominated the software industry for decades, even as other technologies have radically changed around it. A relational database...
3nit-utils (>=0.24.0, <=1.0.2), @36node/template-service (0.3.5) +577 more potentially affected by CVE-2020-35149 via mquery (>=3.0.0, <=3.2.2)
mquery NPM version =3.0.0, =0.24.0, =0.2.0, =3.7.0, =0.1.17, =1.0.0, =0.0.1, =0.0.2, =5.9.7, =0.7.0, =1.0.33, =2.1.3 and more Source cves: CVE-2020-35149 Source advisory: OSV:GHSA-45Q2-34RF-MR94...
Important: Red Hat Security Advisory: Red Hat Data Grid 7.3.8 security update
An update for Red Hat Data Grid is now available. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in the...
3nit-utils (>=0.24.0, <=1.0.2), @36node/template-service (0.3.5) +577 more potentially affected by CVE-2020-35149 via mquery (>=3.0.0, <=3.2.2)
mquery NPM version =3.0.0, =0.24.0, =0.2.0, =3.7.0, =0.1.17, =1.0.0, =0.0.1, =0.0.2, =5.9.7, =0.7.0, =1.0.33, =2.1.3 and more Source cves: CVE-2020-35149 Source advisory: SNYK:JS-MQUERY-1050858...
NICER Protocol Deep Dive: Internet Exposure of Redis
Welcome to the NICER Protocol Deep Dive blog series! When we started researching what all was out on the internet way back in January, we had no idea we'd end up with a hefty, 137-page tome of a research report. The sheer length of such a thing might put off folks who might otherwise learn a thin...
N1QLMap - The Tool Exfiltrates Data From Couchbase Database By Exploiting N1QL Injection Vulnerabilities
N1QLMap is an N1QL exploitation tool. Currently works with Couchbase database. The tool supports data extraction and performing SSRF attacks via CURL. More information can be found here: https://labs.f-secure.com/blog/n1ql-injection-kind-of-sql-injection-in-a-nosql-database. Usage Help usage:...
@colmena/api (0.1.0), agneta-platform (>=0.13.0-beta.1, <=0.13.0-beta.9) +1 more potentially affected by unknown CVE via loopback-connector-mongodb (>=3.1.0, <=3.2.1)
loopback-connector-mongodb NPM version =3.1.0, =0.13.0-beta.1, =0.13.0-beta.9 - scheduler-service-api 1.0.0 Source cves: unknown CVE Source advisory: OSV:GHSA-HXWC-5VW9-2W4W...
NoSQL Injection in loopback-connector-mongodb
Versions of loopback-connector-mongodb prior to 3.6.0 are vulnerable to NoSQL Injection. Filters passed to the database query are not properly sanitized which leads to execution of code on the database driver and data leak. Recommendation Upgrade to version 3.6.0 or later...
GHSA-HXWC-5VW9-2W4W NoSQL Injection in loopback-connector-mongodb
Versions of loopback-connector-mongodb prior to 3.6.0 are vulnerable to NoSQL Injection. Filters passed to the database query are not properly sanitized which leads to execution of code on the database driver and data leak. Recommendation Upgrade to version 3.6.0 or later...
GHSA-F5CV-XRV9-R8W7 NoSQL injection in express-cart
Versions of express-cart before 1.1.8 are vulnerable to NoSQL injection. The vulnerability is caused by the lack of user input sanitization in the login handlers. In both cases, the customer login and the admin login, parameters from the JSON body are sent directly into the MongoDB query which...
NoSQL injection in express-cart
Versions of express-cart before 1.1.8 are vulnerable to NoSQL injection. The vulnerability is caused by the lack of user input sanitization in the login handlers. In both cases, the customer login and the admin login, parameters from the JSON body are sent directly into the MongoDB query which...
@bnabli/wisejs (>=0.0.1, <=0.0.17), @connectonume/ume-module-schemas (>=0.2.0, <=1.5.1) +159 more potentially affected by unknown CVE via mongoose (>=4.0.0, <=4.3.5)
mongoose NPM version =4.0.0, =0.0.1, =0.2.0, =2.0.0, =0.0.0, =0.1.0, =0.1.1, =1.0.0, =0.0.1, =0.0.1, =1.5.0-beta.4, =1.6.0-beta.1 - brisk-mongodb 0.1.1 and more Source cves: unknown CVE Source advisory: OSV:GHSA-R5XW-Q988-826M...
Introduction to SQL: Examples, Best Practices and Pitfalls
SQL Structured Query Language has been with us for more than half a century and it’s not going away anytime soon. Popular in both traditional relational databases and newer NoSQL databases technologies, SQL is widely used for data analytics, Big Data processing, coding languages, and more. I’m a...
GitHub Security Lab: Golang : Add MongoDb NoSQL injection sinks
This bug was reported directly to GitHub Security Lab...
Oracle NoSQL Database Enterprise Server-Side Request Forgery (October 2019 CPU)
The version of Oracle NoSQL Database Enterprise running on the remote host is prior to 19.3.12. It is, therefore, affected by a server-side request forgery vulnerability. The vulnerability exists in the jackson-databind component due to a failure to block the axis2-jaxws class from polymorphic...
Oracle NoSQL Database Installed (Linux)
Binary data oraclenosqlnixinstalled.nbin...
Moderate: Red Hat Security Advisory: Red Hat Data Grid 7.3.4 security update
An update for Red Hat Data Grid is now available. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in the...
Information disclosure in parse-server
you can fetch all the users' objects, by using regex in the NoSQL query. Using the NoSQL, you can use a regex on sessionToken "SessionToken":"$regex":"r:027f" and find valid accounts this way. Using this method, it's possible to retrieve accounts without interaction from the users. GET...
GHSA-H4MF-75HF-67W4 Information disclosure in parse-server
you can fetch all the users' objects, by using regex in the NoSQL query. Using the NoSQL, you can use a regex on sessionToken "SessionToken":"$regex":"r:027f" and find valid accounts this way. Using this method, it's possible to retrieve accounts without interaction from the users. GET...