CVE-2021-45106: Use of Hard-coded Credentials

A vulnerability has been identified in SICAM TOOLBOX II All versions. Affected applications use a circumventable access control within a database service. This could allow an attacker to access the database...

Fortinet FortiAuthenticator Access Control Error Vulnerability

Fortinet FortiAuthenticator is a centralized user identity management solution from Fortinet, Inc. Fortinet FortiAuthenticator is vulnerable to an access control error that could be exploited by an attacker to connect directly to the FAC's database without authentication...

Xmpie Ustore Authorization Issue Vulnerability

Xmpie Ustore is a network printing solution from Xmpie USA. An authorization issue vulnerability exists in XMPie uStore that stems from the product allowing access to the application to steal database information via the included default administrative credentials. The following products and...

log4j: SQL injection in Log4j 1.x when application is configured to use JDBCAppender

A flaw was found in the Java logging library Apache Log4j in version 1.x. JDBCAppender in Log4j 1.x is vulnerable to SQL injection in untrusted data. This allows a remote attacker to run SQL statements in the database if the deployed application is configured to use JDBCAppender with certain...

Online-Movie-Ticket-Booking-System-In-Php SQL Injection Vulnerability

Online-Movie-Ticket-Booking-System-In-Php is an online movie booking system. Online-Movie-Ticket-Booking-System-In-Php suffers from a SQL injection vulnerability that stems from the about.php file not performing input validation on the id parameter. An attacker can append a SQL query to the input...

CVE-2021-36177

An improper access control vulnerability CWE-284 in FortiAuthenticator HA service 6.3.2 and below, 6.2.x, 6.1.x, 6.0.x may allow an attacker on the same vlan as the HA management interface to make an unauthenticated direct connection to the FAC's database...

CVE-2021-36177

An improper access control vulnerability CWE-284 in FortiAuthenticator HA service 6.3.2 and below, 6.2.x, 6.1.x, 6.0.x may allow an attacker on the same vlan as the HA management interface to make an unauthenticated direct connection to the FAC's database...

Fortinet FortiAuthenticator security vulnerability

Fortinet FortiAuthenticator is a centralized user identity management solution from Fortinet, Inc. Fortinet FortiAuthenticator is vulnerable to an access control error that could be exploited by an attacker to connect directly to the FAC's database without authentication...

log4j: SQL injection in Log4j 1.x when application is configured to use JDBCAppender

A flaw was found in the Java logging library Apache Log4j in version 1.x. JDBCAppender in Log4j 1.x is vulnerable to SQL injection in untrusted data. This allows a remote attacker to run SQL statements in the database if the deployed application is configured to use JDBCAppender with certain...

Vulnerability fixed in McAfee Data Loss Prevention

A vulnerability has been fixed in McAfee Data Loss Prevention DLP. The vulnerability potentially allows a malicious party to execute code on the ePolicy Orchestrator-sever ePO. The malicious party must have access to the DLP database on the ePO server. Through a blind-SQL injection, it is possibl...

CVE-2022-23129

Plaintext Storage of a Password vulnerability in Mitsubishi Electric MC Works64 versions 4.04E 10.95.210.01 and prior and ICONICS GENESIS64 versions 10.90 to 10.97 allows a local authenticated attacker to gain authentication information and to access the database illegally. This is because when...

CVE-2022-23129

Plaintext Storage of a Password vulnerability in Mitsubishi Electric MC Works64 versions 4.04E 10.95.210.01 and prior and ICONICS GENESIS64 versions 10.90 to 10.97 allows a local authenticated attacker to gain authentication information and to access the database illegally. This is because when...

Sourcecodester Simple College Website SQL Injection Vulnerability

Sourcecodester Simple College Website is a Sourcecodester open source application. A content management system, Sourcecodester Simple College Website is vulnerable to a SQL injection vulnerability that stems from the application's lack of validation of externally entered SQL statements. An attack...

PT-2022-4548

Name of the Vulnerable Software and Affected Versions Mitsubishi Electric MC Works64 versions 4.04E 10.95.210.01 and prior ICONICS GENESIS64 versions 10.90 to 10.97 Description The issue allows a local authenticated attacker to gain authentication information and access the database illegally due...

CVE-2021-25037

The All in One SEO WordPress plugin before 4.1.5.3 is affected by an authenticated SQL injection issue, which was discovered during an internal audit by the Jetpack Scan team, and could grant attackers access to privileged information from the affected site’s database e.g., usernames and hashed...

PT-2022-9594

Name of the Vulnerable Software and Affected Versions All in One SEO WordPress plugin versions prior to 4.1.5.3 Description The issue is an authenticated SQL injection problem that could grant attackers access to privileged information from the affected site's database, such as usernames and hash...

ZOHO ManageEngine Desktop Central MSP Information Disclosure Vulnerability

ZOHO ManageEngine Desktop Central MSP is a suite of desktop and mobile device management software for MSPs Managed Service Providers from ZOHO USA. The software enables MSPs to remotely manage desktops, servers, and mobile devices in their customer networks, and provides differentiated management...

ZOHO ManageEngine Desktop Central MSP has a vulnerability related to information leakage.

ZOHO ManageEngine Desktop Central MSP is a suite of desktop and mobile device management software for MSPs Managed Service Providers from ZOHO USA. The software enables MSPs to remotely manage desktops, servers, and mobile devices in their customer networks, and provides differentiated management...

CVE-2021-44161: Improper Neutralization of Special Elements used in an SQL Command

Changing MOTP Mobile One Time Password system’s specific function parameter has insufficient validation for user input. A attacker in local area network can perform SQL injection attack to read, modify or delete backend database without authentication...

CVE-2021-44161

Changing MOTP Mobile One Time Password system’s specific function parameter has insufficient validation for user input. A attacker in local area network can perform SQL injection attack to read, modify or delete backend database without authentication...