5505 matches found
piccolo SQL Injection via named transaction savepoints
Summary The handling of named transaction savepoints in all database implementations is vulnerable to SQL Injection as user provided input is passed directly to connection.execute... via f-strings. Details An excerpt of the Postgres savepoint handling: python async def savepointself, name:...
GHSA-XQ59-7JF3-RJC6 piccolo SQL Injection via named transaction savepoints
Summary The handling of named transaction savepoints in all database implementations is vulnerable to SQL Injection as user provided input is passed directly to connection.execute... via f-strings. Details An excerpt of the Postgres savepoint handling: python async def savepointself, name:...
Sql injection
Piccolo is an object-relational mapping and query builder which supports asyncio. Prior to version 1.1.1, the handling of named transaction savepoints in all database implementations is vulnerable to SQL Injection via f-strings. While the likelihood of an end developer exposing a savepoints name...
CVE-2023-47128 piccolo SQL Injection via named transaction savepoints
Piccolo is an object-relational mapping and query builder which supports asyncio. Prior to version 1.1.1, the handling of named transaction savepoints in all database implementations is vulnerable to SQL Injection via f-strings. While the likelihood of an end developer exposing a savepoints name...
kernel: kernel: Denial of Service due to xid leak in cifs_flock()
A flaw was found in the Linux kernel. This vulnerability, a resource leak, occurs in the CIFS Common Internet File System component within the cifsflock function. A local user could exploit this by not using flock, which prevents the transaction identifier xid from being freed, leading to a...
kernel: Kernel: Denial of Service in CIFS due to xid leak
A flaw was found in the Linux kernel's Common Internet File System CIFS implementation. This vulnerability occurs in the cifscreate function where an xid transaction ID is not properly freed if the CIFS connection shuts down. A local attacker could exploit this flaw to cause a resource leak,...
kernel: cifs: Fix xid leak in cifs_ses_add_channel()
A transaction ID xid leak was found in the CIFS/SMB filesystem. When adding a new channel fails, the allocated xid is not freed, leading to gradual exhaustion of the xid pool...
kernel: cifs: Fix xid leak in cifs_copy_file_range()
In the Linux kernel, the following vulnerability has been resolved: cifs: Fix xid leak in cifscopyfilerange If the file is used by swap, before return -EOPNOTSUPP, should free the xid, otherwise, the xid will be leaked...
kernel: ext4: Fix deadlock during directory rename
REJECTED CVE In the Linux kernel, the following vulnerability has been resolved: ext4: Fix deadlock during directory rename As lockdep properly warns, we should not be locking irwsem while having transactions started as the proper lock ordering used by all directory handling operations is irwsem ...
Malware in transaction-decoder
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...
The vulnerability of the Request Tracker system for enterprise-level request tracking and monitoring lies in its excessive data output when searching transactions by authenticated users in the transaction builder. This allows attackers to gain unauthorized access to confidential information.
The vulnerability of the Request Tracker system for enterprise-level order tracking and monitoring exists due to excessive data output by the application when searching transactions for authenticated users in the transaction request builder. Exploiting this vulnerability could allow a malicious...
DEBIAN-CVE-2023-45024
Best Practical Request Tracker RT 5 before 5.0.5 allows Information Disclosure via a transaction search in the transaction query builder...
CVE-2023-45024
Best Practical Request Tracker RT 5 before 5.0.5 allows Information Disclosure via a transaction search in the transaction query builder...
CVE-2023-45024
Best Practical Request Tracker RT 5 before 5.0.5 allows Information Disclosure via a transaction search in the transaction query builder...
CVE-2023-45024
Best Practical Request Tracker RT 5 before 5.0.5 allows Information Disclosure via a transaction search in the transaction query builder...
Information disclosure
Best Practical Request Tracker RT 5 before 5.0.5 allows Information Disclosure via a transaction search in the transaction query builder...
UBUNTU-CVE-2023-45024
Best Practical Request Tracker RT 5 before 5.0.5 allows Information Disclosure via a transaction search in the transaction query builder...
CVE-2023-42029
IBM CICS TX Standard 11.1, Advanced 10.1, 11.1, and TXSeries for Multiplatforms 8.1, 8.2, 9.1 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials...
CVE-2023-43018
IBM CICS TX Standard 11.1 and Advanced 10.1, 11.1 performs an operation at a privilege level that is higher than the minimum level required, which creates new weaknesses or amplifies the consequences of other weaknesses. IBM X-Force ID: 266163...
