Northern.tech CFEngine Security Breach

Northern.tech CFEngine is an IT infrastructure configuration management and automation framework. A security vulnerability exists in Northern.tech CFEngine Enterprise versions 3.6.0 through 3.18.6 and prior to 3.21.3, which stems from an injection flaw in the Web UI, Mission Portal, and results i...

PT-2023-32282 · WordPress · Wd Widgettwitter

Name of the Vulnerable Software and Affected Versions: WD WidgetTwitter plugin for WordPress versions up to, and including, 1.0.9 Description: The issue arises from insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query in the plugin's...

CVE-2023-5315

The Google Maps made Simple plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, 0.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for...

The vulnerability of the WS_FTP Server server lies in the lack of validation for XML objects’ sequences, which allows an attacker to gain access to read and modify the database.

The vulnerability of the Oracle Database management system is related to the lack of validation for the consistency of XML objects. Exploiting this vulnerability can allow an attacker, operating remotely, to gain access to read and modify the database...

CVE-2023-5204

The ChatBot plugin for WordPress is vulnerable to SQL Injection via the $strid parameter in versions up to, and including, 4.8.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated...

CVE-2023-41262

An issue was discovered in /fcgi/scrutfcgi.fcgi in Plixer Scrutinizer before 19.3.1. The csvExportReport endpoint action generateCSV is vulnerable to SQL injection through the sorting parameter, allowing an unauthenticated user to execute arbitrary SQL statements in the context of the application...

CVE-2023-44163

The 'search' parameter of the processsearch.php resource does not validate the characters received and they are sent unfiltered to the database...

PT-2023-28665 · Unknown · Asset Management System

Name of the Vulnerable Software and Affected Versions: Asset Management System version 1.0 Description: The issue is an Authenticated SQL Injection vulnerability that affects the first name and last name parameters of the user.php page. This allows an authenticated attacker to dump all the conten...

PT-2023-28958 · Online Book Store +1 · Online Book Store Project

Name of the Vulnerable Software and Affected Versions: Online Book Store Project affected versions not specified Description: The issue concerns the bookisbn parameter of the "cart.php" resource, which does not validate the characters received, sending them unfiltered to the database. This lack o...

CVE-2023-41335

Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation. When users update their passwords, the new credentials may be briefly held in the server database. While this doesn't grant the server any added capabilities—it already learns the users' passwords as...

GHSA-V5WF-JG37-R9M5 SQLpage vulnerable to public exposure of database credentials

Impact If - you are using a SQLPage version older than v0.11.1 - your SQLPage instance is exposed publicly - the database connection string is specified in the sqlpage/sqlpage.json configuration file not in an environment variable - the webroot is the current working directory the default - your...

Progress MOVEit Transfer SQL Injection Vulnerability

Progress MOVEit Transfer is a secure hosted file transfer application from Progress. A security vulnerability exists in Progress MOVEit Transfer. An attacker exploited the vulnerability to cause modification and disclosure of the contents of the MOVEit database...

PT-2023-27938 · Unknown · Flutter Downloader

Name of the Vulnerable Software and Affected Versions: flutter downloader versions 1.11.1 and earlier Description: A SQL injection in the flutter downloader component allows remote attackers to steal session tokens and overwrite arbitrary files inside the app's container. The internal database of...

CVE-2023-42454 SQLpage vulnerable to public exposure of database credentials

SQLpage is a SQL-only webapp builder. Someone using SQLpage versions prior to 0.11.1, whose SQLpage instance is exposed publicly, with a database connection string specified in the sqlpage/sqlpage.json configuration file not in an environment variable, with the webroot is the current working...

CVE-2023-40715

A cleartext storage of sensitive information vulnerability CWE-312 in FortiTester 2.3.0 through 7.2.3 may allow an attacker with access to the DB contents to retrieve the plaintext password of external servers configured in the device...

PT-2023-27311 · Unknown · Silverware Games

Name of the Vulnerable Software and Affected Versions: Silverware Games versions prior to 1.3.7 Description: The issue concerns a timing difference in the Recovery form of Silverware Games, a premium social network for online gaming, which can indicate whether a specified email address is present...

CVE-2023-37430

Multiple vulnerabilities in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to conduct SQL injection attacks against the EdgeConnect SD-WAN Orchestrator instance. An attacker could exploit these vulnerabilities to obtain and...

CVE-2023-37437 Authenticated SQL Injection Vulnerabilities in EdgeConnect SD-WAN Orchestrator Web-based Management Interface

Multiple vulnerabilities in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to conduct SQL injection attacks against the EdgeConnect SD-WAN Orchestrator instance. An attacker could exploit these vulnerabilities to obtain and...

CVE-2023-37436 Authenticated SQL Injection Vulnerabilities in EdgeConnect SD-WAN Orchestrator Web-based Management Interface

Multiple vulnerabilities in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to conduct SQL injection attacks against the EdgeConnect SD-WAN Orchestrator instance. An attacker could exploit these vulnerabilities to obtain and...

CVE-2023-37435 Authenticated SQL Injection Vulnerabilities in EdgeConnect SD-WAN Orchestrator Web-based Management Interface

Multiple vulnerabilities in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to conduct SQL injection attacks against the EdgeConnect SD-WAN Orchestrator instance. An attacker could exploit these vulnerabilities to obtain and...