1749 matches found
CVE-2020-24617
Mailtrain through 1.24.1 allows SQL Injection in statsClickedSubscribersByColumn in lib/models/campaigns.js via /campaigns/clicked/ajax because variable column names are not properly escaped...
CVE-2020-24617
Mailtrain through 1.24.1 allows SQL Injection in statsClickedSubscribersByColumn in lib/models/campaigns.js via /campaigns/clicked/ajax because variable column names are not properly escaped...
Mailtrain SQL注入漏洞
Mailtrain is an open source hosted newsletter application built on Node.js and MySQL/MariaDB. A SQL injection vulnerability exists in Mailtrain 1.24.1 and earlier in lib/models/campaigns.js in statsClickedSubscribersByColumn. The vulnerability stems from not properly escaping variable column name...
The vulnerability of the PostgreSQL database management system, related to security mechanism errors, allows a perpetrator to obtain column values from error messages (without the privilege for SELECT).
The vulnerability of the PostgreSQL database management system is related to errors in security mechanisms. Exploiting this vulnerability allows a malicious actor to obtain column values from error messages without the privilege to perform a SELECT statement...
USN-4735-1 postgresql-12 vulnerability
Heikki Linnakangas discovered that PostgreSQL incorrectly leaked values of denied columns when handling certain errors. A remote attacker could possibly use this issue to obtain sensitive information...
Information Disclosure
postgresql-13 is vulnerable to information disclosure. An attacker may be able to acquire denied-column values from an error message...
CVE-2020-10375
An issue was discovered in New Media Smarty before 9.10. Passwords are stored in the database in an obfuscated format that can be easily reversed. The file data.mdb contains these obfuscated passwords in the second column. NOTE: this is unrelated to the popular Smarty template engine product...
postgresql: Selectivity estimators bypass row security policies
PostgreSQL maintains column statistics for tables. Certain statistics, such as histograms and lists of most common values, contain values taken from the column. PostgreSQL does not evaluate row security policies before consulting those statistics during query planning; an attacker can exploit thi...
postgresql: Selectivity estimators bypass row security policies
PostgreSQL maintains column statistics for tables. Certain statistics, such as histograms and lists of most common values, contain values taken from the column. PostgreSQL does not evaluate row security policies before consulting those statistics during query planning; an attacker can exploit thi...
CVE-2020-25449
Cross Site Scripting XSS vulnerability in Arachnys Cabot 0.11.12 can be exploited via the Address column...
CVE-2020-25449
Cross Site Scripting XSS vulnerability in Arachnys Cabot 0.11.12 can be exploited via the Address column...
PYSEC-2020-226
Cross Site Scripting XSS vulnerability in Arachnys Cabot 0.11.12 can be exploited via the Address column...
Cross site scripting
Cross Site Scripting XSS vulnerability in Arachnys Cabot 0.11.12 can be exploited via the Address column...
PYSEC-2020-226
Cross Site Scripting XSS vulnerability in Arachnys Cabot 0.11.12 can be exploited via the Address column...
CVE-2020-25449
Cross Site Scripting XSS vulnerability in Arachnys Cabot 0.11.12 can be exploited via the Address column...
CVE-2020-25449
Cross Site Scripting XSS vulnerability in Arachnys Cabot 0.11.12 can be exploited via the Address column...
CVE-2020-25449: Improper Neutralization of Input During Web Page Generation
Cross Site Scripting XSS vulnerability in Arachnys Cabot 0.11.12 can be exploited via the Address column...
PT-2020-16081
Name of the Vulnerable Software and Affected Versions Arachnys Cabot version 0.11.12 Description The issue is a Cross Site Scripting XSS vulnerability that can be exploited via the Address column. This allows for malicious scripts to be injected into the website, potentially leading to unauthoriz...
UNEDITABLE_SCHEMAS and UNEDITABLE_TABLE_DESCRIPTION_MATCH_RULES not respected by frontend service backend
Impact Any install that has UNEDITABLESCHEMAS and/or UNEDITABLETABLEDESCRIPTIONMATCHRULES set in the front-end, is being impacted. The value of these properties is ignored if set, allowing any user to modify table and column descriptions, even though the properties imply they shouldn't be. Patche...
PT-2020-21005
Name of the Vulnerable Software and Affected Versions amundsenfrontendlibrary versions prior to the version that includes the fix for this issue Description The issue affects installations where UNEDITABLE SCHEMAS and/or UNEDITABLE TABLE DESCRIPTION MATCH RULES are set in the front-end. These...