CVE-2023-0620

A flaw was found in HashiCorp Vault and Vault Enterprise, which are vulnerable to SQL injection. This flaw allows a local authenticated attacker to send specially-crafted SQL statements to the Microsoft SQL MSSQL Database Storage Backend, which could allow the attacker to view, add, modify, or...

Security Bulletin: Vulnerability in Log4j affects IBM Integrated Analytics System [CVE-2022-23305]

Summary Redhat provided Log4j is used by IBM Integrated Analytics System. IBM Integrated Analytics System has addressed the applicable CVE-2022-23305 Vulnerability Details CVEID:CVE-2022-23305 DESCRIPTION: Apache Log4j is vulnerable to SQL injection. A remote attacker could send specially-crafted...

K16845: MySQL vulnerability CVE-2015-3152

Security Advisory Description An unspecified vulnerability in the MySQL Client component in Oracle MySQL 5.7.2 and earlier allows an attacker to downgrade MySQL SSL/TLS connections, snoop database queries and results, or directly manipulate database contents. CVE-2015-3152 Impact Although the...

CVE-2023-22794

A flaw was found in RubyGem's activerecord gem, which is vulnerable to SQL injection. This flaw allows a remote attacker to send specially-crafted SQL statements to the comments, allowing the attacker to view, add, modify, or delete information in the back-end database...

Sql injection

A vulnerability was found in 2071174A vinylmap. It has been classified as critical. Affected is the function contact of the file recordstoreapp/views.py. The manipulation leads to sql injection. The name of the patch is b07b79a1e92cc62574ba0492cce000ef4a7bd25f. It is recommended to apply a patch ...

Sql injection

IBM Sterling Partner Engagement Manager 6.1, 6.2, and 6.2.1 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID: 236208...

CVE-2022-40615 IBM Sterling Partner Engagement Manager SQL injection

IBM Sterling Partner Engagement Manager 6.1, 6.2, and 6.2.1 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID: 236208...

CVE-2022-32224

A possible escalation to RCE vulnerability exists when using YAML serialized columns in Active Record 7.0.3.1, 6.1.6.1, 6.0.5.1 and 5.2.8.1 which could allow an attacker, that can manipulate data in the database via means like SQL injection, the ability to escalate to an RCE...

Sql injection

A possible escalation to RCE vulnerability exists when using YAML serialized columns in Active Record 7.0.3.1, 6.1.6.1, 6.0.5.1 and 5.2.8.1 which could allow an attacker, that can manipulate data in the database via means like SQL injection, the ability to escalate to an RCE...

CVE-2022-3850

The Find and Replace All WordPress plugin before 1.3 does not have CSRF check when replacing string, which could allow attackers to make a logged admin replace arbitrary string in database tables via a CSRF attack...

Security Bulletin: IBM Operations Analytics Predictive Insights impacted by Apache Log4j vulnerabilities (CVE-2022-23305)

Summary IBM Operations Analytics Predictive Insights is affected by the Apache Log4j vulnerability through the JDBCAppender in Log4j 1.2.x which accepts a SQL statement as a configuration parameter. When JDBCAppender is specifically configured to use, malicious values could be inserted. This allo...

CVE-2022-42923 SQL injection in Forma LMS

Forma LMS on its 3.1.0 version and earlier is vulnerable to a SQL injection vulnerability. The exploitation of this vulnerability could allow an authenticated attacker with the role of student to perform a SQL injection on the 'id' parameter in the 'appCore/index.php?r=adm/mediagallery/delete'...

Simple Cold Storage Management System manage_storage.php SQL Injection Vulnerability

Simple Cold Storage Management System is a cold storage management system. Simple Cold Storage Management System /csms/admin/storages/managestorage.php?id= is vulnerable to SQL injection. A remote attacker can use this vulnerability to submit a special SQL request to manipulate the database, whic...

Simple Cold Storage Management System delete_booking SQL Injection Vulnerability

Simple Cold Storage Management System is a cold storage management system. simple cold storage management system /csms/classes/Master.php?f=deletebooking is vulnerable to SQL injection, a remote attacker can use this vulnerability to submit a special SQL request to manipulate the database, which...

Simple Cold Storage Management System Master.php SQL Injection Vulnerability

Simple Cold Storage Management System is a cold storage management system. Simple Cold Storage Management System /csms/classes/Master.php?f=deletemessage SQL injection vulnerability can be exploited by a remote attacker to submit a specially crafted SQL request to manipulate a database, obtain...

PT-2022-25601 · Unknown · Exam Reviewer Management System

Name of the Vulnerable Software and Affected Versions: Exam Reviewer Management System version 1.0 Description: The issue concerns SQL Injection via the id parameter. This allows for potential manipulation of database queries, which could lead to unauthorized data access or modification...

ManageEngine Access Manager Plus < 4.3 Build 4305 SQLi

The remote host is running a version of ManageEngine Access Manager Plus prior to 4.3 Build 4305. It is, therefore, affected by a SQL injection vulnerability. An unauthenticated, remote attacker can exploit this to inject or manipulate SQL queries in the back-end database, resulting in the...

CVE-2022-35946

GLPI stands for Gestionnaire Libre de Parc Informatique and is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. In affected versions request input is not properly validated in the plugin controller and can be used ...

PT-2022-23275 · Unknown · Sazanrjb Inventorymanagementsystem

Name of the Vulnerable Software and Affected Versions: sazanrjb InventoryManagementSystem version 1.0 Description: A SQL injection issue in Stocks.java allows attackers to execute arbitrary SQL commands via parameters such as productcode. This enables unauthorized access and manipulation of...

PT-2022-23274 · Unknown · Sazanrjb Inventorymanagementsystem

Name of the Vulnerable Software and Affected Versions: sazanrjb InventoryManagementSystem version 1.0 Description: A SQL injection issue in SupplierDAO.java allows attackers to execute arbitrary SQL commands via parameters such as searchTxt. This enables unauthorized access and manipulation of...