SportsNET SQL Injection Vulnerability (CNVD-2024-37596)

SportsNET is a sports event network application from SportsNET, Inc. SportsNET suffers from a SQL injection vulnerability that can be exploited by an attacker to retrieve, update, and delete all information in the database via a specially crafted SQL query...

SQL Injection

centreon/centreon Web is vulnerable to SQL Injection. The vulnerability is due to improper input validation in the updateServiceHost functionality, allowing attackers to inject malicious SQL code, potentially leading to unauthorized access or manipulation of the database...

CVE-2024-8329

CVE-2024-8329 affects Gether Technology’s 6SHR System. The vulnerability is an SQL injection caused by improper validation of the page parameter, exploitable remotely over a network with low privileges and no user interaction. Impact is read/modify/delete of database contents (high confidentialit...

CVE-2024-29723

CVE-2024-29723 corresponds to SQL injection vulnerabilities in SportsNET, affecting version 4.0.1. The issue is exploitable via a crafted SQL query to the API endpoint /conexiones/ax/openTracExt/ using the parameter categoria, which could allow an attacker to retrieve, update, and delete all info...

CVE-2024-29727

SportsNET (version 4.0.1) contains SQL injection vulnerabilities in the /app/ax/sendParticipationRemember/ endpoint (send parameter). The issue could allow an attacker to retrieve, update, and delete all information in the database. A practical description from PT-2024-22971 notes the risk and pr...

CVE-2024-29726: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerabilities in SportsNET affecting version 4.0.1. These vulnerabilities could allow an attacker to retrieve, update and delete all information in the database by sending a specially crafted SQL query: https://XXXXXXX.saludydesafio.com/app/ax/setAsRead/, parameter id...

PT-2024-22970

Name of the Vulnerable Software and Affected Versions SportsNET version 4.0.1 Description The issue concerns SQL injection vulnerabilities that could allow an attacker to retrieve, update, and delete all information in the database by sending a specially crafted SQL query to the...

PT-2024-22972

Name of the Vulnerable Software and Affected Versions SportsNET version 4.0.1 Description The issue concerns SQL injection vulnerabilities that could allow an attacker to retrieve, update, and delete all information in the database by sending a specially crafted SQL query. The vulnerable API...

CVE-2024-3279

An improper access control vulnerability exists in the mintplex-labs/anything-llm application, specifically within the import endpoint. This vulnerability allows an anonymous attacker, without an account in the application, to import their own database file, leading to the deletion or spoofing of...

CVE-2024-3279: Missing Authentication for Critical Function

An improper access control vulnerability exists in the mintplex-labs/anything-llm application, specifically within the import endpoint. This vulnerability allows an anonymous attacker, without an account in the application, to import their own database file, leading to the deletion or spoofing of...

CVE-2024-3279 Improper Access Control in mintplex-labs/anything-llm

An improper access control vulnerability exists in the mintplex-labs/anything-llm application, specifically within the import endpoint. This vulnerability allows an anonymous attacker, without an account in the application, to import their own database file, leading to the deletion or spoofing of...

CVE-2024-3279 Improper Access Control in mintplex-labs/anything-llm

An improper access control vulnerability exists in the mintplex-labs/anything-llm application, specifically within the import endpoint. This vulnerability allows an anonymous attacker, without an account in the application, to import their own database file, leading to the deletion or spoofing of...

CVE-2024-3279 Improper Access Control in mintplex-labs/anything-llm

An improper access control vulnerability exists in the mintplex-labs/anything-llm application, specifically within the import endpoint. This vulnerability allows an anonymous attacker, without an account in the application, to import their own database file, leading to the deletion or spoofing of...

CVE-2024-3279

The CVE concerns mintplex-labs/anything-llm, specifically the import endpoint. An improper access control flaw allegedly allows anonymous, unauthenticated users to import their own database file, potentially deleting or spoofing the existing anythingllm.db and enabling serving malicious data or c...

CVE-2024-40689

IBM InfoSphere Information Server 11.7 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify, or delete information in the back-end database. IBM X-Force ID: 297719...

CVE-2024-40629

JumpServer is an open-source Privileged Access Management PAM tool that provides DevOps and IT teams with on-demand and secure access to SSH, RDP, Kubernetes, Database and RemoteApp endpoints through a web browser. An attacker can exploit the Ansible playbook to write arbitrary files, leading to...

PT-2024-27799

Name of the Vulnerable Software and Affected Versions Learning Management System Project In PHP With Source Code version 1.0 Description The issue allows attackers to execute arbitrary SQL commands via the id parameter in the processscore.php file. This can lead to unauthorized access and...

CVE-2024-1839

Intrado 911 Emergency Gateway login form is vulnerable to an unauthenticated blind time-based SQL injection, which may allow an unauthenticated remote attacker to execute malicious code, exfiltrate data, or manipulate the database...

CVE-2024-1839: Improper Neutralization of Special Elements used in an SQL Command

Intrado 911 Emergency Gateway login form is vulnerable to an unauthenticated blind time-based SQL injection, which may allow an unauthenticated remote attacker to execute malicious code, exfiltrate data, or manipulate the database...

PT-2024-18350

Name of the Vulnerable Software and Affected Versions Intrado 911 Emergency Gateway affected versions not specified Description The login form of the Intrado 911 Emergency Gateway is vulnerable to an unauthenticated blind time-based SQL injection. This may allow an unauthenticated remote attacker...