PT-2019-19421

Name of the Vulnerable Software and Affected Versions J2Store plugin versions 3.x before 3.3.7 for Joomla! Description The issue allows remote attackers to execute arbitrary SQL commands via the product option parameter. This can lead to unauthorized access and manipulation of database content...

PT-2019-19332

Name of the Vulnerable Software and Affected Versions GoRose version 1.0.4 Description The issue allows for SQL Injection when the order by or group by parameter can be controlled. This could potentially lead to unauthorized access or manipulation of database content. Recommendations For GoRose...

SQL Injection Vulnerability in Sl***_St***.aspx of Bid 1.0 Backend of Qixing Engineering Bidding System

Qixing Bidding System is suitable for enterprises to collect information on government procurement, engineering construction, land grant and other bidding information, and to track the progress of works and payment of successful projects. QiStar Engineering Bidding System Bid 1.0 backend SlSt.asp...

SQL Injection Vulnerability in the Frontend of Worklog 25.0 System by Kaixin Worklog

Worklog is a B/S based software for structuring intra-enterprise collaborative work. A SQL injection vulnerability exists in the frontend of the Qixing Worklog 25.0 system, which can be exploited by attackers to manipulate the database...

SQL Injection Vulnerability in UsualToolCMS 8.0 Release Backend a_re***.php

UsualToolCMS UTCMS is a content management system and rapid site building framework. UsualToolCMS backend are.php suffers from a sql injection vulnerability, which can be exploited by attackers to manipulate the database...

SQL injection vulnerability in Us***_Ro***.aspx file in the background of Qixing intranet OA system.

Qixing OA system formerly Qixing Portal system contains news, notifications, documents, gallery and process form content. A SQL injection vulnerability exists in the backend of Qixing Intranet OA System, which can be exploited by attackers to manipulate the database...

SQL injection vulnerability in My***.aspx file in the background of Qixing intranet OA system

Qixing OA system formerly Qixing Portal system contains news, notifications, documents, gallery and process form content. A SQL injection vulnerability exists in the My.aspx file in the background of the Qixing Intranet OA System, which can be exploited by attackers to manipulate the database...

Joomla BF Survey Pro 2.13.1 SQL Injection

Exploit Title : Joomla BF Survey Pro Components 2.13.1 SQL Injection Author Discovered By : KingSkrupellos Team : Cyberizm Digital Security Army Date : 04/02/2019 Vendor Homepage : tamlynsoftware.com Software Download Link : tamlynsoftware.com/joomla-surveys.html Software Information Link :...

PHP 5.6.x < 5.6.11 Multiple Vulnerabilities (BACKRONYM)

According to its banner, the version of PHP 5.6.x running on the remote web server is prior to 5.6.11. It is, therefore, affected by multiple vulnerabilities : - A security feature bypass vulnerability, known as 'BACKRONYM', exists due to a failure to properly enforce the requirement of an SSL/TL...

PT-2019-8921

Name of the Vulnerable Software and Affected Versions Yeswiki Cercopitheque versions 2018-06-19-1 and earlier Description The issue allows attackers to execute arbitrary SQL commands via the id parameter in the "Bazar" page. This enables unauthorized access and manipulation of database content...

CVE-2018-1000631

Battelle V2I Hub 3.0 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements to the tmx/TmxCtl/src/lib/PluginStatus.cpp and TmxControl::userinfo function, which could allow the attacker to view, add, modify or delete information in the back-end database...

CVE-2018-1000630

Battelle V2I Hub 2.5.1 is vulnerable to SQL injection. A remote authenticated attacker could send specially-crafted SQL statements to /api/PluginStatusActions.php and /status/pluginStatus.php using the jtSorting or id parameter, which could allow the attacker to view, add, modify or delete...

CVE-2018-1000630

Battelle V2I Hub 2.5.1 is vulnerable to SQL injection. A remote authenticated attacker could send specially-crafted SQL statements to /api/PluginStatusActions.php and /status/pluginStatus.php using the jtSorting or id parameter, which could allow the attacker to view, add, modify or delete...

CVE-2018-1000631

Battelle V2I Hub 3.0 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements to the tmx/TmxCtl/src/lib/PluginStatus.cpp and TmxControl::userinfo function, which could allow the attacker to view, add, modify or delete information in the back-end database...

CVE-2018-1819

IBM Financial Transaction Manager for Digital Payments for Multi-Platform 3.0.2, 3.0.4, 3.0.6, and 3.2.0 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end databas...

PT-2018-13715

Name of the Vulnerable Software and Affected Versions IBM Business Process Manager versions 8.5 through 8.6 IBM Business Process Manager versions 18.0.0.0 through 18.0.0.1 Description The issue allows a remote attacker to send specially-crafted SQL statements, potentially enabling the attacker to...

Authentication flaw

An issue was discovered in OpenAFS before 1.6.23 and 1.8.x before 1.8.2. The backup tape controller butc process accepts incoming RPCs but does not require or allow for authentication of those RPCs. Handling those RPCs results in operations being performed with administrator credentials, includin...

UBUNTU-CVE-2018-16947

An issue was discovered in OpenAFS before 1.6.23 and 1.8.x before 1.8.2. The backup tape controller butc process accepts incoming RPCs but does not require or allow for authentication of those RPCs. Handling those RPCs results in operations being performed with administrator credentials, includin...

PT-2018-13820

Name of the Vulnerable Software and Affected Versions IBM Maximo Asset Management versions 7.6 through 7.6.3 Description The issue allows a remote attacker to send specially-crafted SQL statements, potentially enabling them to view, add, modify, or delete information in the back-end database...

CVE-2016-8640

A SQL injection vulnerability in pycsw all versions before 2.0.2, 1.10.5 and 1.8.6 that leads to read and extract of any data from any table in the pycsw database that the database user has access to. Also on PostgreSQL at least it is possible to perform updates/inserts/deletes and database...