Cross site scripting

An issue was discovered in Cloudera Manager 5.x before 5.16.2, 6.0.x before 6.0.2, and 6.1.x before 6.1.1. Malicious impala queries can result in Cross Site Scripting XSS when viewed within this product...

CVE-2019-18455

GitLab Community and Enterprise Edition versions 11–12.4 are affected by a Denial of Service due to a large or infinite loop when building Nested GraphQL queries. Root cause: improper handling of nested GraphQL query expansion leads to resource exhaustion. Impact: availability degradation (DoS) w...

CVE-2016-6353

Cloudera Search in CDH before 5.7.0 allows unauthorized document access because Solr Queries by document id can bypass Sentry document-level security via the RealTimeGetHandler...

Design/Logic Flaw

Cloudera Search in CDH before 5.7.0 allows unauthorized document access because Solr Queries by document id can bypass Sentry document-level security via the RealTimeGetHandler...

CVE-2019-15995

A vulnerability in the web UI of Cisco DNA Spaces: Connector could allow an authenticated, remote attacker to execute arbitrary SQL queries. The vulnerability exists because the web UI does not properly validate user-supplied input. An attacker could exploit this vulnerability by entering malicio...

Sql injection

A vulnerability in the web UI of Cisco DNA Spaces: Connector could allow an authenticated, remote attacker to execute arbitrary SQL queries. The vulnerability exists because the web UI does not properly validate user-supplied input. An attacker could exploit this vulnerability by entering malicio...

CVE-2019-15995 Cisco DNA Spaces: Connector SQL Injection Vulnerability

A vulnerability in the web UI of Cisco DNA Spaces: Connector could allow an authenticated, remote attacker to execute arbitrary SQL queries. The vulnerability exists because the web UI does not properly validate user-supplied input. An attacker could exploit this vulnerability by entering malicio...

ISC BIND DoS Vulnerability (CVE-2019-6477) - Linux

ISC BIND is prone to a denial of service vulnerability as TCP-pipelined queries can bypass tcp-clients limit. Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...

Ubuntu 18.04 LTS : Bind vulnerability (USN-4197-1)

The remote Ubuntu 18.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-4197-1 advisory. It was discovered that Bind incorrectly handled certain TCP-pipelined queries. A remote attacker could possibly use this issue to cause Bind to consume resources,...

Ubuntu: Security Advisory (USN-4197-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

UBUNTU-CVE-2019-18890

A SQL injection vulnerability in Redmine through 3.2.9 and 3.3.x before 3.3.10 allows Redmine users to access protected information via a crafted object query...

USN-4197-1: Bind vulnerability

It was discovered that Bind incorrectly handled certain TCP-pipelined queries. A remote attacker could possibly use this issue to cause Bind to consume resources, resulting in a denial of service...

USN-4197-1 bind9 vulnerability

It was discovered that Bind incorrectly handled certain TCP-pipelined queries. A remote attacker could possibly use this issue to cause Bind to consume resources, resulting in a denial of service...

[slackware-security] bind

New bind packages are available for Slackware 14.0, 14.1, 14.2, and -current to fix a security issue. Here are the details from the Slackware 14.2 ChangeLog: patches/packages/bind-9.11.13-i586-1slack14.2.txz: Upgraded. This update fixes a security issue: Set a limit on the number of concurrently...

Cisco DNA Spaces: Connector SQL Injection Vulnerability

A vulnerability in the web UI of Cisco DNA Spaces: Connector could allow an authenticated, remote attacker to execute arbitrary SQL queries. The vulnerability exists because the web UI does not properly validate user-supplied input. An attacker could exploit this vulnerability by entering malicio...

SQL Injection

contao/core-bundle is vulnerable to SQL injection. The vulnerability exists in the value of strField in the file manager search filter, which allows a remote attacker to inject and execute arbitrary SQL queries through the affected parameter...

UBUNTU-CVE-2019-6477

With pipelining enabled each incoming query on a TCP connection requires a similar resource allocation to a query received via UDP or via TCP without pipelining enabled. A client using a TCP-pipelined connection to a server could consume more resources than the server has been provisioned to...

Metinfo SQL Injection Vulnerability (CNVD-2019-42845)

MetInfo is a content management system CMS developed by China Mito MetInfo using PHP and Mysql. A SQL injection vulnerability exists in MetInfo. The vulnerability stems from a lack of validation of externally entered SQL statements in the database-based application. An attacker can exploit this...

SQL Injection

pimcore/pimcore is vulnerable to SQL injection. The vulnerability exists as the values of id, storeId, pageSize, and tables, used for the SQL query, are not sanitized, allowing a remote attacker to inject and execute arbitrary SQL queries...

CVE-2019-0393

An SQL Injection vulnerability in SAP Quality Management corrected in S4CORE versions 1.0, 1.01, 1.02, 1.03 allows an attacker to carry out targeted database queries that can read individual fields of historical inspection results...