GHSA-F626-677R-J5VQ Withdrawn Advisory: Nette Database SQL injection

Withdrawn Advisory This advisory has been withdrawn as it was reported in error. This link is maintained to preserve external references. Original Description Nette Database through 3.2.4 allows SQL injection in certain situations involving an untrusted filter that is directly passed to the where...

Withdrawn Advisory: Nette Database SQL injection

Withdrawn Advisory This advisory has been withdrawn as it was reported in error. This link is maintained to preserve external references. Original Description Nette Database through 3.2.4 allows SQL injection in certain situations involving an untrusted filter that is directly passed to the where...

CVE-2024-55586

Nette Database through 3.2.4 allows SQL injection in certain situations involving an untrusted filter that is directly passed to the where method. NOTE: the vendor's position is that this is intended behavior...

CVE-2024-55586

Nette Database versions 3.2.4 and earlier are susceptible to SQL injection when an untrusted filter is passed directly to the where method . This vulnerability allows an attacker to manipulate database query logic by constructing malicious SQL statements. Notably, the vendor maintains that this b...

PT-2024-36561 · Nette · Nette Database

Name of the Vulnerable Software and Affected Versions: Nette Database versions 3.2.4 and earlier Description: The issue allows SQL injection in certain situations involving an untrusted filter that is directly passed to the where method. This occurs when there's an untrusted filter sent straight ...

CVE-2024-55586: Improper Neutralization of Special Elements used in an SQL Command

Nette Database through 3.2.4 allows SQL injection in certain situations involving an untrusted filter that is directly passed to the where method. NOTE: the vendor's position is that this is intended behavior...

GHSA-M7XQ-9374-9RVX Mongoose search injection vulnerability

Mongoose versions prior to 8.8.3, 7.8.3, 6.13.5, and 5.13.23 are vulnerable to improper use of the $where operator. This vulnerability arises from the ability of the $where clause to execute arbitrary JavaScript code in MongoDB queries, potentially leading to code injection attacks and unauthoriz...

Mongoose search injection vulnerability

Mongoose versions prior to 8.8.3, 7.8.3, 6.13.5, and 5.13.23 are vulnerable to improper use of the $where operator. This vulnerability arises from the ability of the $where clause to execute arbitrary JavaScript code in MongoDB queries, potentially leading to code injection attacks and unauthoriz...

EUVD-2024-3487

Mongoose before 8.8.3 can improperly use $where in match, leading to search injection...

CVE-2024-53900

Mongoose before 8.8.3 can improperly use $where in match, leading to search injection...

CVE-2024-53900

Mongoose before 8.8.3 can improperly use $where in match, leading to search injection...

CVE-2024-53900: Improper Neutralization of Special Elements used in an SQL Command

Mongoose before 8.8.3 can improperly use $where in match, leading to search injection...

CVE-2024-53900

Mongoose before version 8.8.3 is vulnerable to a critical NoSQL injection (CWE-89) due to the improper use of the $where operator in match queries. This flaw allows unauthenticated attackers to inject arbitrary JavaScript, potentially leading to Remote Code Execution (RCE) and unauthorized access...

PT-2024-35970

Name of the Vulnerable Software and Affected Versions Mongoose versions prior to 8.8.3 Description The issue is related to the improper use of the $where operator in Mongoose, which can lead to search injection and potentially allow a remote attacker to execute arbitrary code and gain read and...

CVE-2024-23169: Improper Neutralization of Input During Web Page Generation

The web interface in RSA NetWitness 11.7.2.0 allows Cross-Site Scripting XSS via the Where textbox on the Reports screen during new rule creation...

PT-2024-19695

Name of the Vulnerable Software and Affected Versions RSA NetWitness version 11.7.2.0 Description The issue concerns a Cross-Site Scripting XSS flaw in the web interface of RSA NetWitness. This flaw is exploited via the Where textbox on the Reports screen during the creation of new rules...

CVE-2024-47438

Substance3D - Painter versions 10.1.0 and earlier are affected by a Write-what-where Condition vulnerability that could lead to a memory leak. This vulnerability allows an attacker to write a controlled value at a controlled memory location, which could result in the disclosure of sensitive memor...

CVE-2024-47438

Substance3D - Painter versions 10.1.0 and earlier are affected by a Write-what-where Condition vulnerability that could lead to a memory leak. This vulnerability allows an attacker to write a controlled value at a controlled memory location, which could result in the disclosure of sensitive memor...

CVE-2024-47438 Substance3D - Painter | Write-what-where Condition (CWE-123)

Substance3D - Painter versions 10.1.0 and earlier are affected by a Write-what-where Condition vulnerability that could lead to a memory leak. This vulnerability allows an attacker to write a controlled value at a controlled memory location, which could result in the disclosure of sensitive memor...

CVE-2024-47438 Substance3D - Painter | Write-what-where Condition (CWE-123)

Substance3D - Painter versions 10.1.0 and earlier are affected by a Write-what-where Condition vulnerability that could lead to a memory leak. This vulnerability allows an attacker to write a controlled value at a controlled memory location, which could result in the disclosure of sensitive memor...