16 matches found
SUSE CVE-2026-69083
SiYuan versions before v3.7.3 contain SQL injection vulnerabilities in the fullTextSearchAssetContent endpoint reachable by unauthenticated users and publish RoleReader tokens. Attackers can execute arbitrary SQL on the read-write asset-content database via unescaped method parameters and REGEXP...
SiYuan: Unauthenticated SQL execution and REGEXP injection via fullTextSearchAssetContent (publish mode): reader-reachable raw SQL (method 2) and unescaped REGEXP (method 3) on read-write asset-content DB
CVE: This vulnerability corresponds to CVE-2026-69083. Summary The /api/search/fullTextSearchAssetContent endpoint exposes two SQL flaws on the asset-content database, both reachable by the publish RoleReader token and by the anonymous account when Publish.Auth.Enable is false: 1. method 2 passes...
GHSA-PQPF-6VQV-6W92 Duplicate Advisory: Unauthenticated SQL execution and REGEXP injection via fullTextSearchAssetContent (publish mode): reader-reachable raw SQL (method 2) and unescaped REGEXP (method 3) on read-write asset-content DB
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-fph3-ghq9-vw66. This link is maintained to preserve external references. Original Description SiYuan versions before v3.7.3 contain SQL injection vulnerabilities in the fullTextSearchAssetContent endpoint...
CVE-2026-69083
SiYuan versions before v3.7.3 contain SQL injection vulnerabilities in the fullTextSearchAssetContent endpoint reachable by unauthenticated users and publish RoleReader tokens. Attackers can execute arbitrary SQL on the read-write asset-content database via unescaped method parameters and REGEXP...
SiYuan: Path Traversal via Double URL Encoding in `/export/` Endpoint (Incomplete Fix Bypass for CVE-2026-30869)
Summary The fix for CVE-2026-30869 in SiYuan v3.5.10 only added a denylist check IsSensitivePath but did not address the root cause — a redundant url.PathUnescape call in serveExport. An authenticated attacker can use double URL encoding %252e%252e to traverse directories and read arbitrary...
EUVD-2017-16854
Malware in sbrugna...
CVE-2017-7879
SQL Injection vulnerability in flatCore version 1.4.6 allows an attacker to read the content database...
Description of the security update for SharePoint Server Subscription Edition Language Pack: December 14, 2021 (KB5002047)
Description of the security update for SharePoint Server Subscription Edition Language Pack: December 14, 2021 KB5002047 Applies To SharePoint Server Subscription Edition Summary This security update resolves a Microsoft SharePoint Server remote code execution vulnerability. To learn more about t...
[ASA-201908-2] python-django: multiple issues
Arch Linux Security Advisory ASA-201908-2 ========================================= Severity: Medium Date : 2019-08-05 CVE-ID : CVE-2019-14232 CVE-2019-14233 CVE-2019-14234 CVE-2019-14235 Package : python-django Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-1015...
CVE-2017-7879
SQL Injection vulnerability in flatCore version 1.4.6 allows an attacker to read the content database...
CVE-2017-7879
SQL Injection vulnerability in flatCore version 1.4.6 allows an attacker to read the content database...
CVE-2017-7879: Improper Neutralization of Special Elements used in an SQL Command
SQL Injection vulnerability in flatCore version 1.4.6 allows an attacker to read the content database...
PT-2017-17969
Name of the Vulnerable Software and Affected Versions flatCore version 1.4.6 Description The issue allows an attacker to read the content database due to a SQL Injection vulnerability. Recommendations For flatCore version 1.4.6, update to a newer version that contains a fix for this issue, howeve...
Lady Gaga website hacked and fans details stolen by Hackers
Lady Gaga website hacked and fans details stolen by Hackers Lady Gaga has called in police after thousands of her fans personal details were stolen from her website. Her record label Univeral acted after the site was hacked into by US cyber attackers SwagSec. A source said: "She's upset and hopes...