839 matches found
JVN#73083905: Multiple vulnerabilities in WBCE CMS
WBCE CMS provided by WBCE Team is an open-source Contents Management System CMS. WBCE CMS contains multiple vulnerabilities listed below. Cross-site scripting CWE-79 - CVE-2017-2118 Version| Vector| Score ---|---|--- CVSS v3| CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N| Base Score: 6.1 CVSS v2|...
CVE-2016-9287: Improper Neutralization of Special Elements used in an SQL Command
In /framework/modules/notfound/controllers/notfoundController.php of Exponent CMS 2.4.0 patch1, untrusted input is passed into getSearchResults. The method getSearchResults is defined in the search model with the parameter '$term' used directly in SQL. Impact is a SQL injection...
PT-2016-7609
Name of the Vulnerable Software and Affected Versions dotCMS versions prior to 3.3.1 Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the sort parameter in the categoriesServlet servlet. Recommendations For versions prior to 3.3.1, update to...
weaver 0A系统在com.eweaver.base.DataAction处存在任意SQL命令执行漏洞
No description provided by source...
HumHub 0.11.20.20.0-beta.2 - SQL Injection
HumHub 0.11.20.20.0-beta.2 - SQL Injection === LSE Leading Security Experts GmbH - Security Advisory 2015-10-14 === HumHub - SQL-Injection ------------------------------------------------------------------------ Tested Versions =============== HumHub 0.11.2 and 0.20.0-beta.2 Issue Overview...
CVE-2015-7036
The fts3tokenizer function in SQLite, as used in Apple iOS before 8.4 and OS X before 10.10.4, allows remote attackers to execute arbitrary code or cause a denial of service application crash via a SQL command that triggers an API call with a crafted pointer value in the second argument...
CVE-2015-7036
The fts3tokenizer function in SQLite, as used in Apple iOS before 8.4 and OS X before 10.10.4, allows remote attackers to execute arbitrary code or cause a denial of service application crash via a SQL command that triggers an API call with a crafted pointer value in the second argument...
PT-2015-7469
Name of the Vulnerable Software and Affected Versions SQLite versions prior to the version in iOS 8.4 and OS X 10.10.4 iOS versions prior to 8.4 OS X versions prior to 10.10.4 Description The issue allows remote attackers to execute arbitrary code or cause a denial of service via a SQL command th...
SUSE-OU-2015:1847-1 Optional update for postgresql94
This update delivers PostgreSQL 9.4.5 to the SUSE Linux Enterprise 12 codebase. Major enhancements: Security and bugfix release 9.4.5: CVE-2015-5289, bsc949670: json or jsonb input values constructed from arbitrary user input can crash the PostgreSQL server and cause a denial of service...
Mango Automation Multiple Vulnerabilities
Mango Automation is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...
PT-2015-7418
Name of the Vulnerable Software and Affected Versions JSP/MySQL Administrador Web version 1 Description A cross-site request forgery CSRF issue allows remote attackers to hijack user authentication for requests that execute arbitrary SQL commands. This is achieved via the cmd parameter to the...
JSPMySQL Administrador CSRF & XSS Vulnerabilities
JSPMySQL Administrador，通过基于jsp技术的B/S模式来远程管理MySQL数据库。下载链接：https://sites.google.com/site/mfpledon/producao-de-software影响版本：JSPMySQL Administrador V.1漏洞类型：CSRF、XSS漏洞等级: 高危CVE-ID：N/A披露时间：供应商通知：2015年8月31日公开披露：2015年9月4日漏洞详情：1）允许远程攻击者在没有CSRF令牌的情况下，在MySQL数据库中执行任意的SQL命令。2）listabd2.jsp中存在XSS的切入点。请求方法：POST ...
PT-2015-7367
Name of the Vulnerable Software and Affected Versions Sophos Cyberoam CR500iNG-XP firewall appliance versions prior to CyberoamOS 10.6.2 MR-1 Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the username parameter to the "login.xml" endpoint...
Debian DLA-152-1 : postgresql-8.4 update
Several vulnerabilities were discovered in PostgreSQL, a relational database server system. The 8.4 branch is EOLed upstream, but still present in Debian squeeze. This new LTS minor version contains the fixes that were applied upstream to the 9.0.19 version, backported to 8.4.22 which was the las...
MGASA-2015-0069 Updated postgresql packages fix security vulnerabilities
Updated postgresql packages fix security vulnerabilities: A user with limited clearance on a table might have access to information in columns without SELECT rights on through server error messages CVE-2014-8161. The function tochar might read/write past the end of a buffer. This might crash the...
[SECURITY] [DLA-152-1] postgresql-8.4 update
Package : postgresql-8.4 Version : 8.4.22lts1-0+deb6u1 CVE ID : CVE-2014-8161 CVE-2015-0241 CVE-2015-0243 CVE-2015-0244 Several vulnerabilities were discovered in PostgreSQL, a relational database server system. The 8.4 branch is EOLed upstream, but still present in Debian squeeze. This new LTS...
[SECURITY] [DSA 3155-1] postgresql-9.1 security update
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 - ------------------------------------------------------------------------- Debian Security Advisory DSA-3155-1 [email protected] http://www.debian.org/security/ Luciano Bello February 06, 2015 http://www.debian.org/security/faq -...
Debian DSA-3155-1 : postgresql-9.1 - security update
Several vulnerabilities have been found in PostgreSQL-9.1, a SQL database system. - CVE-2014-8161: Information leak A user with limited clearance on a table might have access to information in columns without SELECT rights on through server error messages. - CVE-2015-0241: Out of boundaries...
[SECURITY] [DSA 3155-1] postgresql-9.1 security update
------------------------------------------------------------------------- Debian Security Advisory DSA-3155-1 [email protected] http://www.debian.org/security/ Luciano Bello February 06, 2015 http://www.debian.org/security/faq -...
