UBUNTU-CVE-2021-46666

MariaDB before 10.6.2 allows an application crash because of mishandling of a pushdown from a HAVING clause to a WHERE clause...

CVE-2021-46666

MariaDB before 10.6.2 allows an application crash because of mishandling of a pushdown from a HAVING clause to a WHERE clause...

CVE-2021-46666

Removed by vendor...

CVE-2021-46666

MariaDB before 10.6.2 allows an application crash because of mishandling of a pushdown from a HAVING clause to a WHERE clause...

MariaDB 代码问题漏洞

MariaDB is a free and open source database management system from the MariaDB Mariadb Foundation and a forked version of MySQL with the Maria storage engine. MariaDB suffers from a code issue vulnerability that stems from improper handling of the product HAVING clause to WHERE clause push down. A...

CVE-2021-46666: Reachable Assertion

MariaDB before 10.6.2 allows an application crash because of mishandling of a pushdown from a HAVING clause to a WHERE clause...

PT-2021-7932 · Mariadb +6 · Mariadb +7

Name of the Vulnerable Software and Affected Versions: MariaDB versions prior to 10.6.2 Description: The issue is related to the mishandling of a pushdown from a HAVING clause to a WHERE clause, which can cause an application crash. This can be exploited by an attacker to disrupt service...

Privilege Escalation

sqlite3 is vulnerable to privilege escalation. The vulnerability exists through a problem during handling sub-queries with both a correlated WHERE clause and a HAVING 0 clause where the parent query is itself an aggregate...

CVE-2019-9846

RockOA 1.8.7 allows remote attackers to obtain sensitive information because the webmain/webmainAction.php publictreestore method constructs a SQL WHERE clause unsafely by using the pidfields and idfields parameters, aka background SQL injection...

GHSA-XM6R-4466-MR74 OrientDB vulnerable to Improper Privilage Management leading to arbitrary command injection

OrientDB through 2.2.22 does not enforce privilege requirements during "where" or "fetchplan" or "order by" use, which allows remote attackers to execute arbitrary OS commands via a crafted request...

VulnCheck KEV: CVE-2017-11467

OrientDB through 2.2.22 does not enforce privilege requirements during "where" or "fetchplan" or "order by" use, which allows remote attackers to execute arbitrary OS commands via a crafted request...

CVE-2017-11467

OrientDB through 2.2.22 does not enforce privilege requirements during "where" or "fetchplan" or "order by" use, which allows remote attackers to execute arbitrary OS commands via a crafted request...

DEBIAN-CVE-2016-6317

Action Record in Ruby on Rails 4.2.x before 4.2.7.1 does not properly consider differences in parameter handling between the Active Record component and the JSON implementation, which allows remote attackers to bypass intended database-query restrictions and perform NULL checks or trigger missing...

Unsafe Query Generation Risk in Active Record

There is a vulnerability when Active Record is used in conjunction with JSON parameter parsing. This vulnerability is similar to CVE-2012-2660, CVE-2012-2694 and CVE-2013-0155. Impact ------ Due to the way Active Record interprets parameters in combination with the way that JSON parameters are...

MallMold 2.5 app/action/newsletterAction.php SQL注入漏洞

/app/action/newsletterAction.phppublic function statistics //create a image header'Content-type:image/gif'; echo base64decode'R0lGODlhAQABAIAAAAAAAAAAACH5BAEAAAAALAAAAAABAAEAAAICRAEAOw=='; $sn = trim$GET'sn'; $email = trim$GET'ue'; $this-model'newsletter'-statistics$sn, $email;...

UBUNTU-CVE-2013-6417

actionpack/lib/actiondispatch/http/request.rb in Ruby on Rails before 3.2.16 and 4.x before 4.0.2 does not properly consider differences in parameter handling between the Active Record component and the JSON implementation, which allows remote attackers to bypass intended database-query...

rubygem-activerecord: Unsafe Query Generation Risk in Ruby on Rails

Ruby on Rails 3.0.x before 3.0.19, 3.1.x before 3.1.10, and 3.2.x before 3.2.11 does not properly consider differences in parameter handling between the Active Record component and the JSON implementation, which allows remote attackers to bypass intended database-query restrictions and perform NU...

rubygem-activerecord: Unsafe Query Generation Risk in Ruby on Rails

Ruby on Rails 3.0.x before 3.0.19, 3.1.x before 3.1.10, and 3.2.x before 3.2.11 does not properly consider differences in parameter handling between the Active Record component and the JSON implementation, which allows remote attackers to bypass intended database-query restrictions and perform NU...

CVE-2011-5183

Multiple SQL injection vulnerabilities in OrderSys 1.6.4 and earlier allow remote attackers to execute arbitrary SQL commands via the whereclause parameter to 1 index.php, 2 indexlong.php, or 3 indexshort.php in ordering/interfacecreator/...

PT-2012-2160

Name of the Vulnerable Software and Affected Versions OrderSys versions 1.6.4 and earlier Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the where clause parameter to API endpoints such as "index.php", "index long.php", or "index short.php" i...