CVE-2014-8170

ovirtsafedeleteconfig in ovirtfunctions.py and other unspecified locations in ovirt-node 3.0.0-474-gb852fd7 as packaged in Red Hat Enterprise Virtualization 3 do not properly quote input strings, which allows remote authenticated users and physically proximate attackers to execute arbitrary...

SUSE-SU-2017:2039-1 Security update for hawk

This update for hawk fixes the following issues: Security issue fixed: - Set Content-Security-Policy to frame-ancestors 'self' bsc984619 Bug fixes: - Improve ACL rule quoting bsc1042963...

DEBIAN-CVE-2016-7405

The qstr method in the PDO driver in the ADOdb Library for PHP before 5.x before 5.20.7 might allow remote attackers to conduct SQL injection attacks via vectors related to incorrect quoting...

UBUNTU-CVE-2016-7405

The qstr method in the PDO driver in the ADOdb Library for PHP before 5.x before 5.20.7 might allow remote attackers to conduct SQL injection attacks via vectors related to incorrect quoting...

PT-2016-7314 · Php +3 · Adodb Library +3

Name of the Vulnerable Software and Affected Versions: ADODB Library for PHP versions prior to 5.20.7 Description: The issue allows remote attackers to conduct SQL injection attacks due to incorrect quoting in the qstr method of the PDO driver. This can be exploited via vectors related to the...

CVE-2016-7405: Improper Neutralization of Special Elements used in an SQL Command

The qstr method in the PDO driver in the ADOdb Library for PHP before 5.x before 5.20.7 might allow remote attackers to conduct SQL injection attacks via vectors related to incorrect quoting...

SQL Injection

The qstr method in the PDO driver in the ADOdb Library for PHP might allow remote attackers to conduct SQL injection attacks via vectors related to incorrect quoting...

Amazon Linux: Security Advisory (ALAS-2014-370)

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Updated mercurial packages fix CVE-2014-9462

Updated mercurial packages fix security vulnerability: The mercurial source code management system suffers from a code-injection flaw due to insufficient shell quoting in sshpeer.validaterepo CVE-2014-9462...

MGASA-2015-0129 Updated mercurial packages fix CVE-2014-9462

Updated mercurial packages fix security vulnerability: The mercurial source code management system suffers from a code-injection flaw due to insufficient shell quoting in sshpeer.validaterepo CVE-2014-9462...

Updated php-ZendFramework packages fix security vulnerabilities

Due to a bug in PHP's LDAP extension, when ZendFramework's Zendldap class is used for logins, an attacker can login as any user by using a null byte to bypass the empty password check and perform an unauthenticated LDAP bind CVE-2014-8088. The sqlsrv PHP extension, which provides the ability to...

DEBIAN-CVE-2014-0476

The slapper function in chkrootkit before 0.50 does not properly quote file paths, which allows local users to execute arbitrary code via a Trojan horse executable. NOTE: this is only a vulnerability when /tmp is not mounted with the noexec option...

CVE-2014-2528

kcleanup.cpp in KDirStat 2.7.3 does not properly quote strings when deleting a directory, which allows remote attackers to execute arbitrary commands via a ' single quote character in the directory name, a different vulnerability than CVE-2014-2527...

Fedora 19 : rubygem-activerecord-3.2.13-2.fc19 (2014-8089)

Fix for CVE-2014-3482: SQL injection vulnerability in 'bitstring' quoting Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing...

Fedora 19 : ansible-1.6.10-1.fc19 (2014-8904)

Update to 1.6.10 Update to 1.6.9 with more shell quoting fixes. Update to 1.6.7 Fixes CVE-2014-4966 and CVE-2014-4967 Update to 1.6.8 with fixes for shell quoting from previous release. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora...

rubygem-activerecord: SQL injection vulnerability in 'range' quoting

It was discovered that Active Record did not properly quote values of the range type attributes when using the PostgreSQL database adapter. A remote attacker could possibly use this flaw to conduct an SQL injection attack against applications using Active Record...

Important: chkrootkit

Issue Overview: A quoting issue was found in chkrootkit which would lead to a file in /tmp/ being executed, if /tmp/ was mounted without the noexec option. chkrootkit is typically run as the root user. A local attacker could use this flaw to escalate their privileges. Affected Packages: chkrootki...

MGASA-2014-0289 Updated dpkg packages fixes security vulnerabilities

Jakub Wilk discovered that dpkg did not correctly parse C-style filename quoting, allowing for paths to be traversed when unpacking a source package, leading to the creation of files outside the directory of the source being unpacked CVE-2014-0471. Multiple vulnerabilities were discovered in dpkg...

CVE-2014-3483

SQL injection vulnerability in activerecord/lib/activerecord/connectionadapters/postgresql/quoting.rb in the PostgreSQL adapter for Active Record in Ruby on Rails 4.x before 4.0.7 and 4.1.x before 4.1.3 allows remote attackers to execute arbitrary SQL commands by leveraging improper range quoting...

DEBIAN-CVE-2014-3482

SQL injection vulnerability in activerecord/lib/activerecord/connectionadapters/postgresqladapter.rb in the PostgreSQL adapter for Active Record in Ruby on Rails 2.x and 3.x before 3.2.19 allows remote attackers to execute arbitrary SQL commands by leveraging improper bitstring quoting...