CVE-2022-25518

In CMDBuild from version 3.0 to 3.3.2 payload requests are saved in a temporary log table, which allows attackers with database access to read the password of the users who login to the application by querying the database table...

CVE-2022-25518

In CMDBuild from version 3.0 to 3.3.2 payload requests are saved in a temporary log table, which allows attackers with database access to read the password of the users who login to the application by querying the database table...

Default credentials

In CMDBuild from version 3.0 to 3.3.2 payload requests are saved in a temporary log table, which allows attackers with database access to read the password of the users who login to the application by querying the database table...

CVE-2022-25518

CMDBuild versions 3.0–3.3.2 store payload requests in a temporary log table, enabling users with database access to read passwords of logged-in users. This vulnerability is documented across multiple sources (NVD, RH, CVE list) and affects CMDBuild’s login/password handling via the log table. Exp...

CVE-2022-25518

In CMDBuild from version 3.0 to 3.3.2 payload requests are saved in a temporary log table, which allows attackers with database access to read the password of the users who login to the application by querying the database table...

Delta Electronics DIAEnergie SQL injection vulnerability

Delta Electronics DIAEnergie is an industrial energy management system used to monitor and analyze energy consumption in real time, calculate energy consumption and load characteristics, optimize equipment performance, improve production processes, and maximize energy efficiency.Delta Electronics...

Delta Electronics DIAEnergie SQL injection vulnerability

Delta Electronics DIAEnergie is an industrial energy management system used to monitor and analyze energy consumption in real time, calculate energy consumption and load characteristics, optimize equipment performance, improve production processes, and maximize energy efficiency.A SQL injection...

Delta Electronics DIAEnergie SQL injection vulnerability

Delta Electronics DIAEnergie is an industrial energy management system used to monitor and analyze energy consumption in real time, calculate energy consumption and load characteristics, optimize equipment performance, improve production processes, and maximize energy efficiency.Delta Electronics...

Delta Electronics DIAEnergie SQL injection vulnerability

Delta Electronics DIAEnergie is an industrial energy management system used to monitor and analyze energy consumption in real time, calculate energy consumption and load characteristics, optimize equipment performance, improve production processes, and maximize energy efficiency.Delta Electronics...

PT-2022-17347

Name of the Vulnerable Software and Affected Versions CMDBuild versions 3.0 through 3.3.2 Description The issue allows attackers with database access to read user passwords by querying a temporary log table where payload requests are saved. This occurs when users log in to the application...

CVE-2022-25518: Insertion of Sensitive Information into Log File

In CMDBuild from version 3.0 to 3.3.2 payload requests are saved in a temporary log table, which allows attackers with database access to read the password of the users who login to the application by querying the database table...

SQL Injection in tribalsystems/zenario

SQL Injection in Tribalsystems Zenario CMS 8.8.52729 and prior allows remote attackers to access the database or delete the plugin. This is accomplished via the ID input field of ajax.php in the Pugin library - delete module...

GHSA-W4F3-7F7C-X652 SQL Injection in tribalsystems/zenario

SQL Injection in Tribalsystems Zenario CMS 8.8.52729 and prior allows remote attackers to access the database or delete the plugin. This is accomplished via the ID input field of ajax.php in the Pugin library - delete module...

CVE-2022-23387

An issue was discovered in taocms 3.0.2. This is a SQL blind injection that can obtain database data through the Comment Update field...

CVE-2022-25205

A cross-site request forgery CSRF vulnerability in Jenkins dbCharts Plugin 0.5.2 and earlier allows attackers to connect to an attacker-specified database via JDBC using attacker-specified credentials and to determine if a class is available in the Jenkins instance...

CVE-2022-25206

A missing check in Jenkins dbCharts Plugin 0.5.2 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified database via JDBC using attacker-specified credentials...

CSRF vulnerability and missing permission checks in dbCharts

dbCharts 0.5.2 and earlier does not perform a permission check in a method implementing form validation. This allows attackers with Overall/Read permission to connect to an attacker-specified database via JDBC using attacker-specified credentials. Additionally, this method allows attackers to...

CVE-2021-45106

A vulnerability has been identified in SICAM TOOLBOX II All versions. Affected applications use a circumventable access control within a database service. This could allow an attacker to access the database...

Siemens Sicam Toolbox II Trust Management Vulnerabilities

Siemens SICAM TOOLBOX II is an engineering solution for plants and systems of all sizes.An incorrect access control vulnerability exists in Siemens SICAM TOOLBOX II, which could be exploited by an attacker to gain access to the database...

MariaDB Format String Error Vulnerability

MariaDB is a free and open source database management system from the MariaDB Mariadb Foundation and a forked version of MySQL with the Maria storage engine. A format string error vulnerability exists in MariaDB due to a format string error in the CONNECT function implementation. A remote user wi...