MOVEit Transfer - SQL Injection

In Progress MOVEit Transfer before 2021.0.8 13.0.8, 2021.1.6 13.1.6, 2022.0.6 14.0.6, 2022.1.7 14.1.7, and 2023.0.3 15.0.3, a SQL injection vulnerability has been identified in the MOVEit Transfer web application that could allow an unauthenticated attacker to gain unauthorized access to MOVEit...

CVE-2024-42327

CVE-2024-42327 zabbix脆弱性のwriteup 対象: 10.129.231.176 情報: 対象はzabbixサーバーであることが分かっている。zabbixにログインするための標準ユーザーアカウントを受け取った: ユーザー matthew、パスワード 96qzn0h2e1k3。このアカウントは標準ユーザーであり、追加のグループや権限はない。 いつものように、列挙から開始する。nmapを使ってポートスキャンを行う。...

CVE-2024-1301---Badgermeter-moni-tool-SQL-Injection

CVE-2024-1301 --- Badgermeter moni ツール - SQLインジェクション https://www.incibe.es/en/incibe-cert/notices/aviso-sci/multiple-vulnerabilities-badger-meters-monitool CVE-2024-1301: 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | CWE-89. ソフトウェアリンク : https://www.s-can.at/en/product/monitool/ バージョン : 4.6...

CVE-2026-0075

CVE-2026-0075 ContactsProvider 研究用 PoC 管理されたラボ環境向けの Android 研究プロトタイプで、ContactsProvider2 における CVE-2026-0075 に関連する観察可能な挙動を評価するためのものです。 概要 CVE-2026-0075 は、ContactsProvider2 における Android のローカル権限昇格の問題です。公開アドバイザリは、ユーザーの操作なしに SQL インジェクションを通じて連絡先データベースへアクセスする可能性のある経路を説明しています。Android はこの問題を High...

CVE-2026-84034

IBM Guardium Data Protection 12.2 is vulnerable to a hardcoded credentials vulnerability in the hardwareassess/obstore binaries. A low-privileged authenticated user can recover hardcoded product master secrets, potentially resulting in unauthorized access to the internal database and compromise o...

EUVD-2026-83416

IBM Guardium Data Protection 12.2 is vulnerable to a hardcoded credentials vulnerability in the hardwareassess/obstore binaries. A low-privileged authenticated user can recover hardcoded product master secrets, potentially resulting in unauthorized access to the internal database and compromise o...

CVE-2026-84034 IBM Guardium Data Protection is affected by multiple vulnerabilities.

IBM Guardium Data Protection 12.2 is vulnerable to a hardcoded credentials vulnerability in the hardwareassess/obstore binaries. A low-privileged authenticated user can recover hardcoded product master secrets, potentially resulting in unauthorized access to the internal database and compromise o...

CVE-2026-84034

IBM Guardium Data Protection 12.2 is affected by a hardcoded credentials vulnerability (CWE-798) in the hardware_assess/obstore binaries. A low-privileged authenticated user can recover hardcoded product master secrets, potentially gaining unauthorized access to the internal database and compromi...

CVE-2026-92921 admin3 through 3.0.0 Weak Password Hashing via Single-Round MD5

admin3 through 3.0.0 stores account passwords using single-round MD5 with only the username as salt and no key derivation function. Attackers with database access can recover plaintext passwords through offline dictionary or brute-force attacks due to negligible computational effort...

CVE-2026-92921 admin3 through 3.0.0 Weak Password Hashing via Single-Round MD5

admin3 through 3.0.0 stores account passwords using single-round MD5 with only the username as salt and no key derivation function. Attackers with database access can recover plaintext passwords through offline dictionary or brute-force attacks due to negligible computational effort...

EUVD-2026-81576

admin3 through 3.0.0 stores account passwords using single-round MD5 with only the username as salt and no key derivation function. Attackers with database access can recover plaintext passwords through offline dictionary or brute-force attacks due to negligible computational effort...

CVE-2026-20300 Cisco Identity Services Engine SQL Injection Vulnerability

A vulnerability in Cisco ISE could allow an authenticated, remote attacker to conduct SQL injection attacks on an affected device. To exploit this vulnerability, the attacker must have at least low-privileged administrative credentials. This vulnerability is due to improper validation of...

CVE-2026-20242

A vulnerability in the External Database Access feature of Cisco Secure Firewall Management Center FMC Software could allow an unauthenticated, remote attacker to execute arbitrary commands as root on an affected device. This vulnerability is due to insecure deserialization of a user-supplied Jav...

CVE-2026-20242 Cisco Secure Firewall Management Center Software Java Deserialization Remote Code Execution Vulnerability

A vulnerability in the External Database Access feature of Cisco Secure Firewall Management Center FMC Software could allow an unauthenticated, remote attacker to execute arbitrary commands as root on an affected device. This vulnerability is due to insecure deserialization of a user-supplied Jav...

CVE-2026-20242 Cisco Secure Firewall Management Center Software Java Deserialization Remote Code Execution Vulnerability

A vulnerability in the External Database Access feature of Cisco Secure Firewall Management Center FMC Software could allow an unauthenticated, remote attacker to execute arbitrary commands as root on an affected device. This vulnerability is due to insecure deserialization of a user-supplied Jav...

EUVD-2026-81109

A vulnerability in the External Database Access feature of Cisco Secure Firewall Management Center FMC Software could allow an unauthenticated, remote attacker to execute arbitrary commands as root on an affected device. This vulnerability is due to insecure deserialization of a user-supplied Jav...

CVE-2026-20242

CVE-2026-20242 affects the External Database Access feature of Cisco Secure Firewall Management Center (FMC) Software . The root cause is insecure deserialization of a user-supplied Java byte stream. An unauthenticated, remote attacker who controls a host in the configured external database acces...

Cisco Secure Firewall Management Center Software Java Deserialization Remote Code Execution Vulnerability

A vulnerability in the External Database Access feature of Cisco Secure Firewall Management Center FMC Software could allow an unauthenticated, remote attacker to execute arbitrary commands as root on an affected device. This vulnerability is due to insecure deserialization of a user-supplied Jav...

CVE-2026-76449: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability in Cisco Identity Services Engine ISE and Cisco ISE Passive Identity Connector ISE-PIC could allow an authenticated, remote attacker to conduct an SQL or HQL injection attack on an affected device. This vulnerability is due to insufficient validation of user-supplied input to the...

CVE-2026-91924 pgweb through 0.17.0 Missing Authorization on Direct Connect Endpoint

pgweb through 0.17.0 leaves the POST /api/connect endpoint unguarded when connect-backend authorization is configured, allowing attackers to supply arbitrary database connection strings. Attackers can bypass the resource-to-database mapping by providing a custom session identifier and connection...