Django SQL injection vulnerability

An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. QuerySet.values and valueslist methods on models with a JSONField are subject to SQL injection in column aliases via a crafted JSON object key as a passed arg...

PYSEC-2024-70

An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. QuerySet.values and valueslist methods on models with a JSONField are subject to SQL injection in column aliases via a crafted JSON object key as a passed arg...

PYSEC-2024-70

An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. QuerySet.values and valueslist methods on models with a JSONField are subject to SQL injection in column aliases via a crafted JSON object key as a passed arg...

CVE-2024-42005

An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. QuerySet.values and valueslist methods on models with a JSONField are subject to SQL injection in column aliases via a crafted JSON object key as a passed arg...

UBUNTU-CVE-2024-42005

An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. QuerySet.values and valueslist methods on models with a JSONField are subject to SQL injection in column aliases via a crafted JSON object key as a passed arg...

CVE-2024-41804

Xibo is a content management system CMS. An SQL injection vulnerability was discovered in the API route inside the CMS responsible for Adding/Editing DataSet Column Formulas. This allows an authenticated user to to obtain and modify arbitrary data from the Xibo database by injecting specially...

CVE-2024-41804

CVE-2024-41804 affects Xibo CMS (DataSet Column Formulas API). An SQL injection vulnerability is exploitable by an authenticated user via the formula parameter, enabling access to/ modification of arbitrary data in the Xibo database. Remediation: upgrade to Xibo versions 3.3.12 or 4.0.14, which f...

PT-2024-29571 · Xibo · Xibo

Name of the Vulnerable Software and Affected Versions: Xibo versions prior to 3.3.12 Xibo versions prior to 4.0.14 Description: A SQL injection issue was discovered in the API route responsible for Adding/Editing DataSet Column Formulas. This allows an authenticated user to obtain and modify...

Malicious code in two-column-image-text-grid (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 816a60cffab8a3e09e7bdd3135a8d8fdb6bca092a94ec723a64d7aecd057d471 The OpenSSF Package Analysis project identified 'two-column-image-text-grid' @ 69.69.69 npm as malicious. It is considered malicious because: -...

MAL-2024-7695 Malicious code in two-column-image-text-grid (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 816a60cffab8a3e09e7bdd3135a8d8fdb6bca092a94ec723a64d7aecd057d471 The OpenSSF Package Analysis project identified 'two-column-image-text-grid' @ 69.69.69 npm as malicious. It is considered malicious because: -...

SUSE CVE-2024-32229

FFmpeg 7.0 contains a heap-buffer-overflow at libavfilter/vftiltandshift.c:189:5 in copycolumn...

UBUNTU-CVE-2024-32229

FFmpeg 7.0 contains a heap-buffer-overflow at libavfilter/vftiltandshift.c:189:5 in copycolumn...

PT-2024-8678 · FFmpeg · Ffmpeg

Name of the Vulnerable Software and Affected Versions: FFmpeg version 7.0 Description: The issue is related to a heap-buffer-overflow in the copy column function of the libavfilter/vf tiltandshift.c file in the FFmpeg multimedia library. This can allow an attacker to execute arbitrary code...

FFmpeg 安全漏洞

FFmpeg is a complete solution for recording, converting and streaming audio and video from the FFmpeg team. A buffer overflow vulnerability exists in FFmpeg version 7.0, which stems from a boundary error in the copycolumn parameter of libavfilter/vftiltandshift.c:189:5 when handling untrusted...

CVE-2024-25041

IBM Cognos Analytics 11.2.0, 11.2.1, 11.2.2, 11.2.3, 11.2.4, 12.0.0, 12.0.1, and 12.0.2 is potentially vulnerable to cross site scripting XSS. A remote attacker could execute malicious commands due to improper validation of column headings in Cognos Assistant. IBM X-Force ID: 282780...

CVE-2024-25041 IBM Cognos Analytics cross-site scripting

IBM Cognos Analytics 11.2.0, 11.2.1, 11.2.2, 11.2.3, 11.2.4, 12.0.0, 12.0.1, and 12.0.2 is potentially vulnerable to cross site scripting XSS. A remote attacker could execute malicious commands due to improper validation of column headings in Cognos Assistant. IBM X-Force ID: 282780...

GO-2024-2517 Grafana XSS in header column rename in github.com/grafana/grafana

Grafana XSS in header column rename in github.com/grafana/grafana. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners, please suggest an...

GO-2024-2516 Grafana XSS via a column style in github.com/grafana/grafana

Grafana XSS via a column style in github.com/grafana/grafana. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners, please suggest an edit...

PT-2024-20714 · Ibm · Ibm Cognos Analytics

Name of the Vulnerable Software and Affected Versions: IBM Cognos Analytics versions 11.2.0 through 12.0.2 Description: The issue is related to cross site scripting XSS due to improper validation of column headings in Cognos Assistant. A remote attacker could execute malicious commands...

Mass Assignment

Laravel is vulnerable to Mass Assignment. The vulnerability is due to insufficient column quoting for all database drivers, which could allow attackers to perform unauthorized mass assignment operations. If using guarded and passing a user-controlled array into an "update" or "save" function,...