SQL Injection

github.com/ibax-io/go-ibax is vulnerable to SQL injection. The vulnerability exists in the GetRowsInfo function of database.go due to improper argument handling of the database queries which allows an attacker to inject and execute arbitrary SQL queries...

Apache Isis 安全漏洞

Apache Isis is the United States Apache Apache Foundation , a framework for rapid development of domain-driven applications in Java . Apache Isis suffers from an authorization issue vulnerability that stems from the h2 webconsole module accessible in the prototype menu automatically providing the...

Rockwell Automation Factory Talk VantagePoint 安全漏洞

Rockwell Automation Factory Talk VantagePoint is an advanced industrial application ecosystem from Rockwell Automation, Inc. An access control error vulnerability exists in Rockwell Automation Factory Talk VantagePoint, which stems from improper access control of its FactoryTalk VantagePoint...

CVE-2022-39029

Smart eVision has inadequate authorization for the database query function. A remote attacker with general user privilege, who is not explicitly authorized to access the information, can access sensitive information...

CVE-2022-2460 WPDating < 7.4.0 - Multiple Unauthenticated SQLi

The WPDating WordPress plugin before 7.4.0 does not properly escape user input before concatenating it to certain SQL queries, leading to multiple SQL injection vulnerabilities exploitable by unauthenticated users...

CVE-2022-34871

This vulnerability allows remote attackers to escalate privileges on affected installations of Centreon. Authentication is required to exploit this vulnerability. The specific flaw exists within the configuration of poller resources. The issue results from the lack of proper validation of a...

PT-2022-21310

Name of the Vulnerable Software and Affected Versions Product Show Room Site version 1.0 Description The issue is related to SQL Injection via the /psrs/classes/Master.php?f=delete product API endpoint. This allows for potential manipulation of database queries. No information is provided about t...

PT-2022-22406 · Centreon · Centreon

Name of the Vulnerable Software and Affected Versions: Centreon affected versions not specified Description: This issue allows remote attackers to escalate privileges on affected installations. Authentication is required to exploit this issue. The specific flaw exists within the configuration of...

GHSA-73PR-G6JJ-5HC9 Externally Controlled Reference to a Resource in Another Sphere in ruby-mysql

A malicious actor can read arbitrary files from a client that uses ruby-mysql to communicate to a rogue MySQL server and issue database queries. In these cases, the server has the option to create a database reply using the LOAD DATA LOCAL statement, which instructs the client to provide addition...

Externally Controlled Reference to a Resource in Another Sphere in ruby-mysql

A malicious actor can read arbitrary files from a client that uses ruby-mysql to communicate to a rogue MySQL server and issue database queries. In these cases, the server has the option to create a database reply using the LOAD DATA LOCAL statement, which instructs the client to provide addition...

PT-2022-23723 · Ivanti · Ivanti Avalanche

Name of the Vulnerable Software and Affected Versions: Ivanti Avalanche version 6.3.2.3490 Description: This issue allows remote attackers to bypass authentication on affected installations. Although authentication is required to exploit this issue, the existing authentication mechanism can be...

PT-2022-23717 · Ivanti · Ivanti Avalanche

Name of the Vulnerable Software and Affected Versions: Ivanti Avalanche version 6.3.2.3490 Description: This issue allows remote attackers to bypass authentication on affected installations. Although authentication is required to exploit this issue, the existing authentication mechanism can be...

The vulnerability in the virtual learning environment Moodle, related to the lack of measures to protect the SQL query structure, allows attackers to execute arbitrary SQL queries in the database.

The vulnerability in the virtual training environment Moodle is related to the lack of measures taken to protect the SQL query structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary SQL queries in the database...

SAP NetWeaver AS ABAP Multiple Vulnerabilities (Feb 2022)

Multiple vulnerabilities may be present in SAP NetWeaver Application Server ABAP, including the following: - SAP Netweaver AS - versions 700, 701, 702, 710, 711, 730, 740, 750, 751, 752, 753, 754, 755, 756 - contain a cross-site scripting vulnerability that allows an unauthenticated attacker to...

CVE-2022-22540

SAP NetWeaver AS ABAP Workplace Server - versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 787, allows an attacker to execute crafted database queries, that could expose the backend database. Successful attacks could result in disclosure of a table of contents from the system,...

PT-2022-15510 · Sap · Sap Netweaver As Abap

Name of the Vulnerable Software and Affected Versions: SAP NetWeaver AS ABAP Workplace Server versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 787 Description: The issue allows an attacker to execute crafted database queries, potentially exposing the backend database. Successf...

CVE-2021-43971

A SQL injection vulnerability in /mobile/SelectUsers.jsp in SysAid ITIL 20.4.74 b10 allows a remote authenticated attacker to execute arbitrary SQL commands via the filterText parameter...

WordPress SQL注入漏洞

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A security vulnerability exists in WordPress versions prior to 5.8.3, which stems from a lack of...

PT-2022-15018

Name of the Vulnerable Software and Affected Versions WordPress versions prior to 5.8.3 WordPress versions prior to 4.1.34 Description WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database. Due to lack of proper sanitization in one of the...

Solarwinds Web Help Desk 信任管理问题漏洞

Solarwinds Web Help Desk is a suite of help desk and asset management software from Solarwinds USA. The software supports centralized knowledge base, IT asset management, project and task management, and other features. SolarWinds Web Help Desk suffers from a trust management issue vulnerability...