Medium: libpq

Issue Overview: A man-in-the-middle attacker can inject false responses to the client's first few queries, despite the use of SSL certificate verification and encryption. CVE-2021-23222 Affected Packages: libpq Note: This advisory is applicable to Amazon Linux 2 - Postgresql14 Extra. Visit this...

The vulnerability of the MSSQL Database Storage Backend component in the platform for archiving corporate information, HashiCorp Vault and Vault Enterprise, allows a perpetrator to execute arbitrary SQL commands.

The vulnerability of the MSSQL Database Storage Backend component in the HashiCorp Vault and Vault Enterprise archiving platforms relates to the lack of security measures for SQL query structures. Exploiting this vulnerability allows attackers to execute arbitrary SQL commands...

Membership Management System 1.0 SQL Injection

Title: Membership Management System - SQL injection - Application: Hospital Management System - Date: 01.03.2024 - Bugs: SQL injection - Exploit Author: SoSPiro - Vendor Homepage: https://codeastro.com/author/nbadmin/ - Software Link:...

CVE-2024-25833

F-logic DataCube3 v1.0 is vulnerable to unauthenticated SQL injection, which could allow an unauthenticated malicious actor to execute arbitrary SQL queries in database...

The vulnerability of the Ultimate Member plugin for the WordPress content management system allows a hacker to execute arbitrary SQL queries against the database.

The vulnerability of the Ultimate Member plugin for the WordPress content management system is related to the lack of protective measures for the SQL query structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary SQL queries against the database remotely...

Field Logic DataCube3 Security Vulnerability

Field Logic DataCube4 is a small measurement terminal system from Field Logic. A security vulnerability exists in Field Logic DataCube3 version 1.0 that stems from vulnerability to unauthenticated SQL injection, which could allow an unauthenticated malicious actor to execute arbitrary SQL queries...

CVE-2024-25833

F-logic DataCube3 v1.0 is vulnerable to unauthenticated SQL injection, which could allow an unauthenticated malicious actor to execute arbitrary SQL queries in database...

CVE-2024-25833

F-logic DataCube3 v1.0 is vulnerable to unauthenticated SQL injection, which could allow an unauthenticated malicious actor to execute arbitrary SQL queries in database...

The vulnerability of the monitoringwizard.php file, a monitoring tool for IT infrastructure, allows a malicious actor to execute arbitrary SQL queries.

The vulnerability of the monitoringwizard.php file, a tool for monitoring IT infrastructure, relates to the possibility of embedding commands. Exploiting this vulnerability allows a malicious actor to execute arbitrary SQL queries remotely...

WordPress Plugin NotificationX Security Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed using the PHP language, which supports personal blog sites on servers running PHP and MySQL.WordPress plugin i...

PT-2024-2074 · Unknown · Subrion Cms

Name of the Vulnerable Software and Affected Versions: Subrion CMS version 4.2.1 Description: The issue is related to a potential SQL injection vulnerability in the ia.core.mysqli.php component of the Subrion CMS system. This could allow a remote attacker to execute arbitrary SQL queries. However...

postgresql: non-owner 'REFRESH MATERIALIZED VIEW CONCURRENTLY' executes arbitrary SQL

A flaw was found in PostgreSQL. A late privilege drop in REFRESH MATERIALIZED VIEW CONCURRENTLY in PostgreSQL can allow an object creator to execute arbitrary SQL functions as the command issuer. The command intends to run SQL functions as the owner of the materialized view, enabling a safe refre...

Fedora 38 : bind9-next (2024-c36c448396)

The remote Fedora 38 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-c36c448396 advisory. Security Fixes - Validating DNS messages containing a lot of DNSSEC signatures could cause excessive CPU load, leading to a denial-of-service...

Flashcard Quiz App v1.0 - (card) SQL Injection Vulnerability

Exploit Title: Flashcard Quiz App v1.0 - 'card' SQL Injection Application: Flashcard Quiz App Bugs: SQL Injection Exploit Author: SoSPiro Vendor Homepage: https://www.sourcecodester.com/ Software Link: https://www.sourcecodester.com/php/17160/flashcard-quiz-app-using-php-and-mysql-source-code.htm...

Sante PACS Server Token Endpoint SQL Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Sante PACS Server. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of HTTP requests on port 3000. When parsing the token parameter, the...

PT-2024-18372 · Unknown · Sante Pacs Server

Name of the Vulnerable Software and Affected Versions: Sante PACS Server affected versions not specified Description: This issue allows remote attackers to execute arbitrary code on affected installations of Sante PACS Server. Authentication is not required to exploit this issue. The specific fla...

PT-2024-5200 · NetGear · Netgear Prosafe Network Management System

Name of the Vulnerable Software and Affected Versions: NETGEAR ProSAFE Network Management System affected versions not specified Description: The issue is related to the getFilterString method in the NETGEAR ProSAFE Network Management System, which lacks proper validation of a user-supplied strin...

GHSA-8XFF-473H-F863 Uncaught Exception Handling Parsing Errors on Line Terminators

The span rendering would panic when handling failed parsing of queries where the error occurred on a line terminator character. Impact A client that is authorized to run queries in a SurrealDB server is able to execute a malformed query which will fail to parse on a line terminator character and...

Siemens SINEC NMS SQL Injection Vulnerability (CNVD-2024-09309)

SINEC NMS is a new generation network management system NMS for digital enterprises. Siemens SINEC NMS suffers from a SQL injection vulnerability that can be exploited by an attacker to execute arbitrary SQL queries on the server database...

PT-2026-60944

Name of the Vulnerable Software and Affected Versions SurrealDB versions prior to 1.2.1 Description An uncaught exception occurs during span rendering when the system parses queries containing errors on line terminator characters. Authorized clients can trigger a panic in the span rendering code ...