PT-2015-7044

Name of the Vulnerable Software and Affected Versions Open-Xchange OX Guard versions prior to 2.0.0-rev8 Description The issue concerns a SQL injection vulnerability in the public key discovery API call. This allows remote authenticated users to execute arbitrary SQL commands. Recommendations For...

PT-2015-7112

Name of the Vulnerable Software and Affected Versions refbase versions prior to 0.9.7 Description The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via the where parameter to "rss.php" or the sqlQuery parameter to "search.php". Recommendations For versions...

PT-2015-7545

Name of the Vulnerable Software and Affected Versions ManageEngine EventLog Analyzer versions 10.6 build 10060 and earlier Description The issue allows remote attackers to bypass intended restrictions and execute arbitrary SQL commands. This can be achieved by sending an allowed query followed by...

Mango Automation 2.6.0 SQL Query Cross Site Request Forgery

Mango Automation 2.6.0 CSRF Arbitrary SQL Query Execution Vendor: Infinite Automation Systems Inc. Product web page: http://www.infiniteautomation.com/ Affected version: 2.5.2 and 2.6.0 beta build 327 Summary: Mango Automation is a flexible SCADA, HMI And Automation software application that allo...

CVE-2015-5703: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in the public key discovery API call in Open-Xchange OX Guard before 2.0.0-rev8 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors...

CVE-2015-7387: Improper Neutralization of Special Elements used in an SQL Command

ZOHO ManageEngine EventLog Analyzer 10.6 build 10060 and earlier allows remote attackers to bypass intended restrictions and execute arbitrary SQL commands via an allowed query followed by a disallowed one in the query parameter to event/runQuery.do, as demonstrated by "SELECT 1;INSERT INTO." Fix...

Sql injection

SQL injection vulnerability in the web interface in Cisco Unity Connection 9.11.2 and earlier allows remote authenticated users to execute arbitrary SQL commands via a crafted POST request, aka Bug ID CSCuv63824...

PT-2015-4168

Name of the Vulnerable Software and Affected Versions Symantec Endpoint Protection versions prior to 12.1.6 Description The issue concerns SQL injection vulnerabilities in the Manager component's interface PHP scripts. These vulnerabilities allow remote authenticated users with the Limited...

PT-2015-7163

Name of the Vulnerable Software and Affected Versions Cisco Unity Connection versions 9.11.2 and earlier Description The issue allows remote authenticated users to execute arbitrary SQL commands via a crafted POST request. Recommendations For Cisco Unity Connection versions 9.11.2 and earlier,...

Cisco Unity Connection Web Interface SQL Injection Vulnerability

A vulnerability in the web interface of Cisco Unity Connection UC could allow an authenticated, remote attacker to impact the confidentiality of the system by executing arbitrary SQL queries. The vulnerability is due to a lack of input validation on user-supplied input in SQL queries. An attacker...

Sql injection

SQL injection vulnerability in the BPFINDJOBSWITHPROGRAM function module in SAP NetWeaver J2EE Engine 7.40 allows remote attackers to execute arbitrary SQL commands via unspecified vectors...

PT-2015-7488

Name of the Vulnerable Software and Affected Versions SAP NetWeaver J2EE Engine version 7.40 Description The issue allows remote attackers to execute arbitrary SQL commands. This is due to a SQL injection vulnerability in the BP FIND JOBS WITH PROGRAM function module. Recommendations For SAP...

CVE-2015-7239: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in the BPFINDJOBSWITHPROGRAM function module in SAP NetWeaver J2EE Engine 7.40 allows remote attackers to execute arbitrary SQL commands via unspecified vectors...

Sql injection

Multiple SQL injection vulnerabilities in dexreservations.php in the CP Reservation Calendar plugin before 1.1.7 for WordPress allow remote attackers to execute arbitrary SQL commands via the 1 id parameter in a dexreservationscalendarload2 action or 2 dexitem parameter in a...

CVE-2015-6962

SQL injection vulnerability in the web application in Farol allows remote attackers to execute arbitrary SQL commands via the email parameter to tkmonitor/estrutura/login/Login.actions.php...

Sql injection

SQL injection vulnerability in the web application in Farol allows remote attackers to execute arbitrary SQL commands via the email parameter to tkmonitor/estrutura/login/Login.actions.php...

CVE-2015-6962

SQL injection vulnerability in the web application in Farol allows remote attackers to execute arbitrary SQL commands via the email parameter to tkmonitor/estrutura/login/Login.actions.php...

PT-2015-7424

Name of the Vulnerable Software and Affected Versions Farol affected versions not specified Description The issue allows remote attackers to execute arbitrary SQL commands via the email parameter to "tkmonitor/estrutura/login/Login.actions.php" API endpoint. Recommendations At the moment, there i...

CVE-2015-6829

Multiple SQL injection vulnerabilities in the getip function in wp-limit-login-attempts.php in the WP Limit Login Attempts plugin before 2.0.1 for WordPress allow remote attackers to execute arbitrary SQL commands via the 1 X-Forwarded-For or 2 Client-IP HTTP header...

CVE-2015-6944

Cross-site request forgery CSRF vulnerability in JSP/MySQL Administrador Web 1 allows remote attackers to hijack the authentication of users for requests that execute arbitrary SQL commands via the cmd parameter to sys/sys/listaBD2.jsp...