Sql injection

Archery is an open source SQL audit platform. The Archery project contains multiple SQL injection vulnerabilities, that may allow an attacker to query the connected databases. Affected versions are subject to SQL injection in the sqlapi/apiworkflow.py endpoint ExecuteCheck which passes unfiltered...

CVE-2023-30558

CVE-2023-30558 affects Archery, an open source SQL audit platform. The vulnerability arises from multiple SQL injection flaws in the sql/data_dictionary.py table_list endpoint, where untrusted input from the db_name parameter is concatenated into SQL queries and passed to database engines. Affect...

CVE-2023-30557

CVE-2023-30557 affects Archery, an open-source SQL audit/management tool. The vulnerability arises from SQL injection in the data_dictionary.py table_info endpoint, where user input from db_name and tb_name is unsafely concatenated into SQL queries and passed to database engines (sql/engines/mssq...

CVE-2023-30556 SQL injection in sql_optimize.py optimize_sqltuningadvisor method in Archery - GHSL-2022-107

Archery is an open source SQL audit platform. The Archery project contains multiple SQL injection vulnerabilities, that may allow an attacker to query the connected databases. Affected versions are subject to SQL injection in the optimizesqltuningadvisor method of sqloptimize.py. User input comin...

CVE-2023-30556

CVE-2023-30556 concerns an SQL injection in Archery, an open source SQL audit platform. The vulnerability affects the function/flow where user input from the db_name parameter in sql_optimize.py is passed to the sqltuningadvisor method in oracle.py, enabling attackers to query connected databases...

CVE-2023-30556 SQL injection in sql_optimize.py optimize_sqltuningadvisor method in Archery - GHSL-2022-107

Archery is an open source SQL audit platform. The Archery project contains multiple SQL injection vulnerabilities, that may allow an attacker to query the connected databases. Affected versions are subject to SQL injection in the optimizesqltuningadvisor method of sqloptimize.py. User input comin...

CVE-2023-30555 SQL injection in sql_optimize.py explain method in Archery - GHSL-2022-108

Archery is an open source SQL audit platform. The Archery project contains multiple SQL injection vulnerabilities, that may allow an attacker to query the connected databases.Affected versions are subject to SQL injection in the explain method in sqloptimize.py. User input coming from the dbname...

CVE-2023-30555

CVE-2023-30555 concerns Archery, an open-source SQL audit platform, with multiple SQL injection vulnerabilities in the explain endpoint. The root cause is that user input from the db_name parameter is passed to database engine queries (query methods in sql/engines/mssql.py and sql/engines/oracle....

CVE-2023-30553 Multiple SQL injections in sql_api/api_workflow.py endpoint in Archery - GHSL-2022-102

Archery is an open source SQL audit platform. The Archery project contains multiple SQL injection vulnerabilities, that may allow an attacker to query the connected databases. Affected versions are subject to multiple SQL injections in the sqlapi/apiworkflow.py endpoint ExecuteCheck. User input...

CVE-2023-30553

CVE-2023-30553 affects Archery, an open-source SQL audit platform, containing multiple SQL injection vulnerabilities in the sql_api/api_workflow.py ExecuteCheck endpoint. User input from db_name and full_sql in ExecuteCheck is concatenated into SQL queries by vulnerable code paths in sql/engines/...

CVE-2023-30552

CVE-2023-30552 concerns Archery, an open source SQL audit platform. The provided documents describe multiple SQL injection vulnerabilities in the Archery project, specifically in the sql/instance.py endpoint’s describe method. The root cause is unsafe concatenation of user input (tb_name, db_name...

CVE-2023-30552 SQL injection in sql/instance.py endpoint in Archery - GHSL-2022-101

Archery is an open source SQL audit platform. The Archery project contains multiple SQL injection vulnerabilities, that may allow an attacker to query the connected databases. Affected versions are subject to SQL injection in the sql/instance.py endpoint's describe method. In several cases, user...

CVE-2023-1831

Mattermost fails to redact from audit logs the user password during user creation and the user password hash in other operations if the experimental audit logging configuration was enabled ExperimentalAuditSettings section in config...

Code injection

Mattermost fails to redact from audit logs the user password during user creation and the user password hash in other operations if the experimental audit logging configuration was enabled ExperimentalAuditSettings section in config...

CVE-2023-1831 User password logged in audit logs

Mattermost fails to redact from audit logs the user password during user creation and the user password hash in other operations if the experimental audit logging configuration was enabled ExperimentalAuditSettings section in config...

CVE-2023-1831 User password logged in audit logs

Mattermost fails to redact from audit logs the user password during user creation and the user password hash in other operations if the experimental audit logging configuration was enabled ExperimentalAuditSettings section in config...

CVE-2023-1831

CVE-2023-1831 affects Mattermost Server. When the experimental audit logging (ExperimentalAuditSettings) is enabled, audit logs fail to redact the user password during account creation and the user password hash in other operations, exposing sensitive credentials in logs. The vulnerability is des...

CVE-2023-1831 User password logged in audit logs

Mattermost fails to redact from audit logs the user password during user creation and the user password hash in other operations if the experimental audit logging configuration was enabled ExperimentalAuditSettings section in config...

Mattermost 安全漏洞

Mattermost is an open source collaboration platform from Mattermost, Inc. in the United States. Mattermost suffers from a security vulnerability that stems from the inability to edit user passwords during user creation and hashes of user passwords in other operations from audit logs...

PT-2023-17267 · Unknown · Mattermost

Name of the Vulnerable Software and Affected Versions: Mattermost affected versions not specified Description: The issue concerns the failure to redact sensitive information from audit logs. Specifically, it affects the user password during user creation and the user password hash in other...