postgresql: server processes unencrypted bytes from man-in-the-middle

It was found that a PostgreSQL server could accept plain text data during the establishment of an SSL connection. When a user is requesting a certificate based authentication, an active Person in the Middle could use this flaw in order to inject arbitrary SQL commands...

WordPress SQL注入漏洞

WordPress is the WordPress Foundation's set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.The WordPress WP Visitor Statistics plugin has a SQL injection vulnerability in versions prior to 4.8. The...

The vulnerability of the prod_filter parameter in the “device_list” component of the monitoring software for Advantech R-SeeNet routers allows a perpetrator to carry out cross-site scripting attacks.

The vulnerability of the prodfilter parameter in the “devicelist” component of the Advantech R-SeeNet monitoring software relates to the improper handling of the prodfilter parameter. Exploiting this vulnerability allows a remote attacker to perform cross-site scripting attacks by sending special...

Jfrog JFrog Artifactory SQL注入漏洞

Jfrog JFrog Artifactory is an open source, general-purpose Artifact repository manager from Israel's JFrog Jfrog that supports clustered and high-availability Docker registries and provides an end-to-end solution for automating artifacts used to track artifacts from development to production. JFr...

CVE-2020-18081

The checkuser function of SEMCMS 3.8 was discovered to contain a vulnerability which allows attackers to obtain the password in plaintext through a SQL query...

Tcman Gim SQL注入漏洞

Tcman Gim is a facility management software from Tcman Spain designed for use on mobile devices. TCMAN GIM suffers from a SQL injection vulnerability that can be exploited via the "/PC/WebService.asmx" page...

postgresql: server processes unencrypted bytes from man-in-the-middle

It was found that a PostgreSQL server could accept plain text data during the establishment of an SSL connection. When a user is requesting a certificate based authentication, an active Person in the Middle could use this flaw in order to inject arbitrary SQL commands...

CVE-2021-42945

A SQL Injection vulnerability exists in ZZCMS 2021 via the askbigclassid parameter in /admin/ask.php...

Tuleap SQL注入漏洞

Enalean Tuleap is a set of open source software development and project management tools from the French company Enalean. The tool provides enterprise application lifecycle management, as well as project tracking, source code management and team collaboration.Enalean Tuleap is vulnerable to SQL...

ThinkPHP SQL注入漏洞

ThinkPHP is a set of PHP-based, open source, lightweight Web application development framework from China Top Think Information Technology. thinkPHP has SQL injection vulnerability, there is no detailed vulnerability details provided...

PT-2021-5674 · Microsoft · Defender For Iot

Name of the Vulnerable Software and Affected Versions: Microsoft Defender for IoT affected versions not specified Description: The issue is related to incorrect code generation management in Microsoft Defender for IoT, allowing a remote attacker to execute arbitrary code using a specially crafted...

CVE-2021-3817

wbcecms is vulnerable to Improper Neutralization of Special Elements used in an SQL Command...

ZZCMS SQL注入漏洞

ZZCMS is a content management system CMS from the Zzcms team in China. zzcms is vulnerable to SQL injection, which allows an attacker to use the id parameter in admin/bad.php with a lack of validation for external input SQL statements. An attacker can use the vulnerability to execute illegal SQL...

The vulnerability of the ArcGIS Server server, related to the lack of measures taken to protect the SQL query structure, allows attackers to execute arbitrary SQL queries.

The vulnerability of the ArcGIS Server server is related to the lack of measures taken to protect the SQL query structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary SQL queries remotely...

CVE-2021-41063

SQL injection vulnerability was discovered in Aanderaa GeoView Webservice prior to version 2.1.3 that could allow an unauthenticated attackers to execute arbitrary commands...

CVE-2021-40860

A SQL Injection in the custom filter query component in Genesys intelligent Workload Distribution IWD before 9.0.013.11 allows an attacker to execute arbitrary SQL queries via the qlexpression parameter, with which all data in the database can be extracted and OS command execution is possible...

Fortinet FortiWLM SQL注入漏洞

Fortinet FortiWLM is a wireless manager from Fortinet, Inc. An SQL injection vulnerability exists in Fortinet FortiWLM versions 8.6.1 and below, which can be exploited by attackers to contaminate database data and extract sensitive information via crafted HTTP requests to be sent to alarms and...

The vulnerability of the surname_filter parameter in the user_list.php script of the Advantech R-SeeNet monitoring software allows a hacker to disclose protected information.

The vulnerability of the surnamefilter parameter in the userlist.php script of the Advantech R-SeeNet monitoring software relates to the lack of protection for the SQL query structure. Exploiting this vulnerability allows a malicious actor to disclose sensitive information through a specially...

CVE-2021-43035

An issue was discovered in Kaseya Unitrends Backup Appliance before 10.5.5. Two unauthenticated SQL injection vulnerabilities were discovered, allowing arbitrary SQL queries to be injected and executed under the postgres superuser account. Remote code execution was possible, leading to full acces...

Piwigo SQL注入漏洞

Piwigo is a set of Web-based open source image library software. Piwigo v11.5 contains a security vulnerability in /admin/batchmanagerglobal.php in which the parameter pwgtoken is not sufficiently escaped and filtered. No details of the vulnerability are available at this time...