CVE-2018-11772: Improper Neutralization of Special Elements used in an SQL Command

Apache VCL versions 2.1 through 2.5 do not properly validate cookie input when determining what node if any was previously selected in the privilege tree. The cookie data is then used in an SQL statement. This allows for an SQL injection attack. Access to this portion of a VCL system requires adm...

PT-2019-8798

Name of the Vulnerable Software and Affected Versions Apache VCL versions 2.1 through 2.5 Description The issue arises from improper validation of form input when adding and removing VMs to and from hosts, which is then used in SQL statements, allowing for an SQL injection attack. Access to this...