6527 matches found
Centreon Poller Broker SQL Injection Privilege Escalation Vulnerability
This vulnerability allows remote attackers to escalate privileges on affected installations of Centreon. Authentication is required to exploit this vulnerability. The specific flaw exists within the handling of requests to modify poller broker configuration. The issue results from the lack of...
graphql-java: DoS by malicious query
A flaw was found in GraphQL Java. This flaw allows an attacker to use a malicious query in GraphQL to cause a denial of service due to inefficient lexer input validation...
The vulnerability of the admin/ask.php implementation in the ZZCMS CMS system allows a hacker to execute arbitrary SQL queries.
The vulnerability of the admin/ask.php implementation in the ZZCMS CMS system relates to the lack of measures taken to protect the SQL query structure during the processing of the askbigclassid parameter. Exploiting this vulnerability allows a malicious actor to execute arbitrary SQL queries...
Rockwell Automation Factory Talk VantagePoint 安全漏洞
Rockwell Automation Factory Talk VantagePoint is an advanced industrial application ecosystem from Rockwell Automation, Inc. An access control error vulnerability exists in Rockwell Automation Factory Talk VantagePoint, which stems from improper access control of its FactoryTalk VantagePoint...
CVE-2022-2928
In ISC DHCP 4.4.0 - 4.4.3, ISC DHCP 4.1-ESV-R1 - 4.1-ESV-R16-P1, when the function optioncodehashlookup is called from addoption, it increases the option's refcount field. However, there is not a corresponding call to optiondereference to decrement the refcount field. The function addoption is on...
Oracle Linux 9 : bind (ELSA-2022-6763)
The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2022-6763 advisory. - Fix possible serve-stale related crash CVE-2022-3080 - Fix memory leak in ECDSA verify processing CVE-2022-38177 Tenable has extracted the preceding...
UBUNTU-CVE-2022-2928
In ISC DHCP 4.4.0 - 4.4.3, ISC DHCP 4.1-ESV-R1 - 4.1-ESV-R16-P1, when the function optioncodehashlookup is called from addoption, it increases the option's refcount field. However, there is not a corresponding call to optiondereference to decrement the refcount field. The function addoption is on...
The vulnerability of the Central Management Console (CMC) component of the SAP BusinessObjects Business Intelligence platform allows a perpetrator to disclose protected information or cause service interruptions.
The vulnerability of the Central Management Console CMC component of the SAP BusinessObjects Business Intelligence platform is related to the possibility of manipulating inter-site queries. Exploiting this vulnerability could allow a malicious actor to disclose sensitive information or cause...
SQL Injection
moodle/moodle is vulnerable to sql injection attacks. The vulnerability exists in getuserslisting function of datalib.php due to improper implementation of sort helper and column mapping for sort which allows an attacker to inject malicious queries into the system...
MySQL Performance Tuning: Top 5 Tips for Blazing Fast Queries
By Owais Sultan Patience is no longer a virtue when talking about website or app performance. Users get frustrated after waiting for… This is a post from HackRead.com Read the original post: MySQL Performance Tuning: Top 5 Tips for Blazing Fast Queries...
Centreon Poller Resource SQL Injection Privilege Escalation Vulnerability
This vulnerability allows remote attackers to escalate privileges on affected installations of Centreon. Authentication is required to exploit this vulnerability. The specific flaw exists within the handling of requests to configure poller resources. The issue results from the lack of proper...
Sourcecodester Hotel and Lodge Management System 2.0 - SQL Injection
Sourcecodester Hotel and Lodge Management System 2.0 contains a SQL injection vulnerability via the email parameter to the edit page for Customer, Room, Currency, Room Booking Details, or Tax Details. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized...
SolarWinds Network Performance Monitor UpdateActionsDescriptions SQL Injection Privilege Escalation Vulnerability
This vulnerability allows remote attackers to escalate privileges on affected installations of SolarWinds Network Performance Monitor. Authentication is required to exploit this vulnerability. The specific flaw exists within the UpdateActionsDescriptions function. The issue results from the lack ...
CVE-2020-15338
Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a "Use of GET Request Method With Sensitive Query Strings" issue for /cnr requests...
CVE-2020-15333
Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 allows attackers to discover accounts via MySQL "select from Administratorusers" and "select from Usersusers" requests...
CVE-2022-39029
Smart eVision has inadequate authorization for the database query function. A remote attacker with general user privilege, who is not explicitly authorized to access the information, can access sensitive information...
CVE-2022-32228
An information disclosure vulnerability exists in Rocket.Chat v5, v4.8.2 and v4.7.5 since the getReadReceipts Meteor server method does not properly filter user inputs that are passed to MongoDB queries, allowing $regex queries to enumerate arbitrary Message IDs...
Information disclosure
An information disclosure vulnerability exists in Rocket.Chat v5, v4.8.2 and v4.7.5 due to the actionLinkHandler method was found to allow Message ID Enumeration with Regex MongoDB queries...
CVE-2022-32218
CVE-2022-32218 – Rocket.Chat information disclosure : The vulnerability stems from actionLinkHandler/ actionLinks.getMessage not validating input, allowing authenticated users to enumerate Message IDs via a regex MongoDB query. Impact: potential exposure of sensitive information by enumerating ex...
