PT-2021-3978

Name of the Vulnerable Software and Affected Versions FortiPortal versions 4.2.2 and earlier FortiPortal versions 5.2.0 through 5.2.5 FortiPortal versions 5.3.0 through 5.3.5 FortiPortal versions 6.0.0 through 6.0.4 Description The issue is related to multiple improper neutralization of special...

CVE-2021-37832: Improper Neutralization of Special Elements used in an SQL Command

A SQL injection vulnerability exists in version 3.0.2 of Hotel Druid when SQLite is being used as the application database. A malicious attacker can issue SQL commands to the SQLite database through the vulnerable idappartamenti parameter...

CVE-2021-24007

Multiple improper neutralization of special elements of SQL commands vulnerabilities in FortiMail before 6.4.4 may allow a non-authenticated attacker to execute unauthorized code or commands via specifically crafted HTTP requests...

PT-2021-3587

Name of the Vulnerable Software and Affected Versions FortiMail versions prior to 6.4.4 Description The issue is related to multiple improper neutralization of special elements of SQL commands in FortiMail, which may allow a non-authenticated attacker to execute unauthorized code or commands via...

CVE-2021-29099: Improper Neutralization of Special Elements used in an SQL Command

A SQL injection vulnerability exists in some configurations of ArcGIS Server versions 10.8.1 and earlier. Specially crafted web requests can expose information that is not intended to be disclosed not customer datasets. Web Services that use file based data sources file Geodatabase or Shape Files...

Sql injection

Improper neutralization of special elements used in an SQL command 'SQL Injection' vulnerability in thumbnail component in Synology Photo Station before 6.8.14-3500 allows remote attackers users to execute arbitrary SQL commands via unspecified vectors...

Sql injection

Improper neutralization of special elements used in an SQL command 'SQL Injection' vulnerability in PHP component in Synology Photo Station before 6.8.14-3500 allows remote authenticated users to execute arbitrary SQL command via unspecified vectors...

CVE-2021-29090: Improper Neutralization of Special Elements used in an SQL Command

Improper neutralization of special elements used in an SQL command 'SQL Injection' vulnerability in PHP component in Synology Photo Station before 6.8.14-3500 allows remote authenticated users to execute arbitrary SQL command via unspecified vectors...

PT-2021-3994

Name of the Vulnerable Software and Affected Versions Synology Photo Station versions prior to 6.8.14-3500 Description The issue is related to the improper neutralization of special elements used in SQL commands, which can be exploited to execute arbitrary SQL commands. This can be done by remote...

Vulnerability in core server (CVE-2021-32028)

Memory disclosure in INSERT ... ON CONFLICT ... DO UPDATE Using an INSERT ... ON CONFLICT ... DO UPDATE command on a purpose-crafted table, an attacker can read arbitrary bytes of server memory. In the default configuration, any authenticated database user can create prerequisite objects and...

Security Bulletin: Search path vulnerability in PostgreSQL Server bundled in IBM Robotic Process Automation with Automation Anywhere (CVE-2020-14349, CVE-2020-14350)

Summary The version of PostgreSQL server bundled with IBM Robotic Process Automation with Automation Anywhere did not properly sanitize the searchpath during logical replication. An authenticated attacker could use this flaw to execute arbitrary SQL command in the context of the user used for...

CVE-2021-28142: Improper Neutralization of Special Elements used in an SQL Command

CITSmart before 9.1.2.28 mishandles the "filtro de autocomplete."...

CVE-2021-20678: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in the Paid Memberships Pro versions prior to 2.5.6 allows remote authenticated attackers to execute arbitrary SQL commands via unspecified vectors...

NewStart CGSL MAIN 6.02 : sqlite Multiple Vulnerabilities (NS-SA-2021-0064)

The remote NewStart CGSL host, running version MAIN 6.02, has sqlite packages installed that are affected by multiple vulnerabilities: - An exploitable use after free vulnerability exists in the window function functionality of Sqlite3 3.26.0. A specially crafted SQL command can cause a use after...

CVE-2021-23352: Improper Neutralization of Special Elements used in an SQL Command

This affects the package madge before 4.0.1. It is possible to specify a custom Graphviz path via the graphVizPath option parameter which when the .image, .svg or .dot functions are called, is executed by the childprocess.exec function...

GHSA-9PGX-GCPH-MPQR vrana/adminer via XSS in the history parameter in SQL command

Impact Users of Adminer versions supporting SQL command most versions, e.g. MySQL using browsers not encoding URL parameters before sending to server likely Edge, not Chrome, not Firefox are affected. Patches Patched by 5c395afc, included in version 4.7.9. Workarounds Use browser which encodes UR...

vrana/adminer via XSS in the history parameter in SQL command

Impact Users of Adminer versions supporting SQL command most versions, e.g. MySQL using browsers not encoding URL parameters before sending to server likely Edge, not Chrome, not Firefox are affected. Patches Patched by 5c395afc, included in version 4.7.9. Workarounds Use browser which encodes UR...

Cisco Smart Software Manager On-Prem SQL Injection

The vulnerability of the Web interface for managing Cisco Smart Software Manager On-Prem software licenses is related to the lack of measures taken to protect the SQL query structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary SQL commands remotely...

Confirmed Zero-day vulnerability in the SonicWall SMA100 build version 10.x

A vulnerability resulting in improper SQL command neutralization in the SonicWall SSLVPN SMA100 product allows remote exploitation for credential access by an unauthenticated attacker. This vulnerability impacts SMA100 build version 10.x. CVE: CVE-2021-20016 Last updated: Feb. 3, 2021, 9:11 p.m...

CVE-2021-1247: Improper Neutralization of Special Elements used in an SQL Command

Multiple vulnerabilities in certain REST API endpoints of Cisco Data Center Network Manager DCNM could allow an authenticated, remote attacker to execute arbitrary SQL commands on an affected device. For more information about these vulnerabilities, see the Details section of this advisory...