CVE-2018-9019

SQL Injection vulnerability in Dolibarr before version 7.0.2 allows remote attackers to execute arbitrary SQL commands via the sortfield parameter to /accountancy/admin/accountmodel.php, /accountancy/admin/categorieslist.php, /accountancy/admin/journalslist.php, /admin/dict.php,...

CVE-2018-9019

SQL Injection vulnerability in Dolibarr before version 7.0.2 allows remote attackers to execute arbitrary SQL commands via the sortfield parameter to /accountancy/admin/accountmodel.php, /accountancy/admin/categorieslist.php, /accountancy/admin/journalslist.php, /admin/dict.php,...

Sql injection

SQL Injection vulnerability in Dolibarr before version 7.0.2 allows remote attackers to execute arbitrary SQL commands via the sortfield parameter to /accountancy/admin/accountmodel.php, /accountancy/admin/categorieslist.php, /accountancy/admin/journalslist.php, /admin/dict.php,...

BD Kiestra and InoquIA Systems (Update A)

1. EXECUTIVE SUMMARY CVSS v3 6.3 ATTENTION : Exploitable from adjacent network Vendor : Becton, Dickinson and Company BD Equipment : BD Kiestra and InoqulA systems Vulnerabilities : Product UI does not Warn User of Unsafe Actions 2. UPDATE INFORMATION This updated advisory is a follow-up to the...

PT-2018-3603

Name of the Vulnerable Software and Affected Versions Dolibarr versions prior to 7.0.2 Description The issue allows remote attackers to execute arbitrary SQL commands via the sortfield parameter to "/accountancy/admin/accountmodel.php", "/accountancy/admin/categories list.php",...

CVE-2018-9250

interface\super\editlist.php in OpenEMR before v5011 allows remote authenticated users to execute arbitrary SQL commands via the newlistname parameter...

CVE-2018-9250

interface\super\editlist.php in OpenEMR before v5011 allows remote authenticated users to execute arbitrary SQL commands via the newlistname parameter...

PT-2018-18932

Name of the Vulnerable Software and Affected Versions OpenEMR versions prior to 5.0.1.1 Description The issue allows remote authenticated users to execute arbitrary SQL commands. This is achieved via the newlistname parameter in the 'interfacesuperedit list.php' file. Recommendations For versions...

Sql injection

SQL injection vulnerability in UPnP DMA in Synology Media Server before 1.7.6-2842 and before 1.4-2654 allows remote attackers to execute arbitrary SQL commands via the ObjectID parameter...

CVE-2018-8734: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in the core config manager in Nagios XI 5.2.x through 5.4.x before 5.4.13 allows an attacker to execute arbitrary SQL commands via the selInfoKey1 parameter...

PT-2018-8889

Name of the Vulnerable Software and Affected Versions Cybozu Garoon versions 3.5.0 through 4.2.6 Description The issue allows remote authenticated attackers to execute arbitrary SQL commands. Recommendations For versions 3.5.0 through 4.2.6, update to a version that contains a fix for this issue...

A Deep Dive into Database Attacks [Part IV]: Delivery and Execution of Malicious Executables through SQL Commands (MySQL)

In a previous post we covered different techniques for execution of SQL and OS commands through Microsoft SQL server that can be used for delivering and executing malicious payloads on the target system. In this post we’ll discuss the same topic for MySQL database. Creating an executable directly...

CVE-2018-8820

An issue was discovered in Square 9 GlobalForms 6.2.x. A Time Based SQL injection vulnerability in the "match" parameter allows remote authenticated attackers to execute arbitrary SQL commands. It is possible to upgrade access to full server compromise via xpcmdshell. In some cases, the...

Sql injection

DISPUTED SQL injection vulnerability in SQLiteDatabase.java in the SQLi Api in Android allows remote attackers to execute arbitrary SQL commands via the delete method...

CVE-2014-4959

Technical details about CVE-2014-4959 are not publicly provided in the included documents; no affected products, root cause, impact, or remediation are specified. Monitor for updates.

PT-2018-4231

Name of the Vulnerable Software and Affected Versions Android affected versions not specified Description A disputed SQL injection issue in SQLiteDatabase.java within the SQLi Api allows remote attackers to execute arbitrary SQL commands via the delete method. Recommendations At the moment, there...

CVE-2018-8802

SQL injection vulnerability in the management interface in ePortal Manager allows remote attackers to execute arbitrary SQL commands via unspecified parameters...

Sql injection

SQL injection vulnerability in the management interface in ePortal Manager allows remote attackers to execute arbitrary SQL commands via unspecified parameters...

CVE-2018-8802

SQL injection vulnerability in the management interface in ePortal Manager allows remote attackers to execute arbitrary SQL commands via unspecified parameters...

PT-2018-18629

Name of the Vulnerable Software and Affected Versions ePortal Manager affected versions not specified Description A SQL injection issue in the management interface of ePortal Manager allows remote attackers to execute arbitrary SQL commands via unspecified parameters. Recommendations At the momen...