PT-2022-23501 · Yimioa · Yimioa

Name of the Vulnerable Software and Affected Versions: Yimioa version 6.1 Description: A SQL injection issue was found in Yimioa via the orderbyGET parameter. This allows for potential manipulation of database queries. Recommendations: For Yimioa version 6.1, consider restricting access to the...

PT-2022-22918

Name of the Vulnerable Software and Affected Versions sazanrjb InventoryManagementSystem version 1.0 Description A SQL injection issue in UserDAO.java allows attackers to execute arbitrary SQL commands via the user parameter. This enables unauthorized access and manipulation of database content...

Remote Code Execution (RCE)

activerecord is vulnerable to Remote Code Execution RCE. Active Record uses YAML.unsafeload to convert the YAML data in to Ruby objects allowing an attacker who can manipulate data in the database to execute malicious code remotely...

CVE-2022-32248

Due to missing input validation in the Manage Checkbooks component of SAP S/4HANA - version 101, 102, 103, 104, 105, 106, an attacker could insert or edit the value of an existing field in the database. This leads to an impact on the integrity of the data...

Sql injection

IBM Security Access Manager Appliance 10.0.0.0, 10.0.1.0, 10.0.2.0, and 10.0.3.0 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID: 22507...

PT-2022-15449

Name of the Vulnerable Software and Affected Versions IBM Security Access Manager Appliance versions 10.0.0.0 through 10.0.3.0 Description The issue allows a remote attacker to send specially crafted SQL statements, which could enable the attacker to view, add, modify, or delete information in th...

PT-2022-20712

Name of the Vulnerable Software and Affected Versions Online Ordering System version 2.3.2 Description The issue is related to a SQL injection vulnerability. It can be exploited via the "/ordering/admin/store/index.php?view=edit&id=" API endpoint, specifically through the id variable. This...

PT-2022-20986

Name of the Vulnerable Software and Affected Versions Online Tutor Portal Site version 1.0 Description The issue concerns a SQL Injection vulnerability via the "/otps/classes/Master.php?f=delete team" API endpoint. This allows for potential unauthorized access and manipulation of database content...

PT-2022-11453

Name of the Vulnerable Software and Affected Versions Wuzhicms version 4.1.0 Description The issue allows attackers to execute arbitrary SQL commands via the keyValue parameter in the "/coreframe/app/pay/admin/index.php" API endpoint. This enables attackers to manipulate database queries,...

Security Bulletin: Financial Transaction Manager for Digital Payments is affected by a potential SQL Injection CVE-2020-4328

Summary Financial Transaction Manager for Digital Payments FTM DP for Multi-Platform has addressed the following vulnerability. SQL Injection on some of the screens. Vulnerability Details CVEID: CVE-2020-4328 DESCRIPTION: IBM Financial Transaction Manager is vulnerable to SQL injection. A remote...

PT-2022-21233

Name of the Vulnerable Software and Affected Versions Fast Food Ordering System version 1.0 Description The issue concerns a SQL Injection vulnerability via the "/ffos/classes/Master.php?f=delete menu" API endpoint. This allows for potential unauthorized access and manipulation of database conten...

PT-2022-21259

Name of the Vulnerable Software and Affected Versions Product Show Room Site version 1.0 Description The issue concerns SQL Injection via the "/psrs/classes/Master.php?f=delete inquiry" API endpoint. This allows for potential manipulation of database queries. No information is provided about the...

CVE-2022-31768

IBM InfoSphere Information Server 11.7 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database...

PT-2022-20915

Name of the Vulnerable Software and Affected Versions IBM InfoSphere Information Server version 11.7 Description The issue allows a remote attacker to send specially crafted SQL statements, potentially enabling them to view, add, modify, or delete information in the back-end database. This is due...

PT-2022-20325

Name of the Vulnerable Software and Affected Versions elitecms version 1.01 Description The issue concerns SQL Injection via the "/admin/edit page.php?page=" endpoint. This allows for potential manipulation of database queries. No information is provided about the estimated number of affected...

PT-2022-20320

Name of the Vulnerable Software and Affected Versions Online Ordering System version 1.0 Description The issue concerns a SQL Injection vulnerability via the "admin/vieworders.php" endpoint. This allows for potential unauthorized access and manipulation of database content. Recommendations For...

PT-2022-20695

Name of the Vulnerable Software and Affected Versions Online Ordering System version 2.3.2 Description The issue allows for SQL Injection via the /ordering/admin/user/index.php?view=edit&id= API endpoint, specifically targeting the id variable. This could potentially lead to unauthorized access o...

Design/Logic Flaw

A vulnerability in the health check RPM of Cisco IOS XR Software could allow an unauthenticated, remote attacker to access the Redis instance that is running within the NOSi container. This vulnerability exists because the health check RPM opens TCP port 6379 by default upon activation. An attack...

GHSA-7PR3-34RG-G53M Magento Unrestricted file upload vulnerability

An unrestricted file upload vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated admin user can manipulate the Synchronization feature in the Media File Storage of the database to transform uploaded JPEG file into a PHP file...

PT-2022-15416

Name of the Vulnerable Software and Affected Versions IBM Robotic Process Automation versions 21.0.0 through 21.0.2 Description The issue allows a remote attacker to send specially crafted SQL statements, potentially enabling them to view, add, modify, or delete information in the back-end...