CVE-2014-5140

CVE-2014-5140 affects Loaded Commerce 7. The vulnerability is in the bindReplace function of the query factory (includes/classes/database.php), which does not properly handle colon characters. This enables SQL injection via the First name and Last name fields in the address book when used by remo...

CVE-2019-19732

translationmanagetext.ajax.php and various manage.ajax.php in MFScripts YetiShare 3.5.2 through 4.5.3 directly insert values from the aSortDir0 and/or sSortDir0 parameter into a SQL string. This allows an attacker to inject their own SQL and manipulate the query, typically extracting data from th...

U.S. Dept Of Defense: Leaked DB credentials on https://██████████.mil/███

Summary: Information disclosure with login credentials for ms-sql database exposed. Description: I've found a PHP info file disclosed on https://█████.mil/██████ containing login credentials for a database cloud server ███████ as well as information on the host system such as hostname, username a...

SQL Server 2019 Security Tool Inadvertently Reveals Where Sensitive Data is Stored

The first step in protecting your data and ensuring your database is compliant with security benchmarks and privacy regulations such as SOX, PCI, HIPAA, and GDPR is to understand what sensitive information resides in that database. Microsoft’s SQL Server 2019 introduces a new tool SQL Data...

CVE-2019-5278

CVE-2019-5278 affects Huawei GaussDB-100 OLTP (CampusInsight) prior to V100R019C00SPC200. The vulnerability is an out-of-bounds read in the Advanced Packages feature. With specific permissions, an attacker can issue crafted SQL statements to the database, potentially causing a crash. The issue is...

Equinox Control Expert CVE-2019-18234 SQL Injection Vulnerability

Description Equinox Control Expert is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data. Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying...

Red Sail OA system has SQL injection vulnerability

Redfan OA is based on SOA architecture, with EIP enterprise information portal and BPM business process engine as the core. Red Sail OA system has SQL injection vulnerability, attackers can use the vulnerability to obtain database sensitive information...

CVE-2019-19018

TitanHQ WebTitan (before 5.18) is affected. The issue exposes a database configuration file under /include/dbconfig.ini via the web administration interface, revealing which database backend the web application uses. The vulnerability is a information disclosure in the admin interface. Exploitati...

IBM Sterling B2B Integrator CVE-2019-4387 SQL Injection Vulnerability

Description IBM Sterling B2B Integrator is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data. Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying...

Database with 1.2 billion people’s data leaked online without password

By Sudais In total, the database was home to over 4 terabytes of data sitting in plain sight for public access. This is a post from HackRead.com Read the original post: Database with 1.2 billion people's data leaked online without password...

Sql injection

An issue was discovered in phpMyAdmin before 4.9.2. A crafted database/table name can be used to trigger a SQL injection attack through the designer feature...

Sql injection

In Progress MOVEit Transfer 10.2 before 10.2.6 2018.3, 11.0 before 11.0.4 2019.0.4, and 11.1 before 11.1.3 2019.1.3, multiple SQL Injection vulnerabilities have been found in the REST API that could allow an unauthenticated attacker to gain unauthorized access to the database. Depending on the...

CVE-2019-18464

CVE-2019-18464 affects Progress MOVEit Transfer REST API across the affected branches: 10.2 before 10.2.6 (2018.3), 11.0 before 11.0.4 (2019.0.4), and 11.1 before 11.1.3 (2019.1.3). The vulnerability is SQL Injection in the REST API that can allow an unauthenticated attacker to gain unauthorized ...

UBUNTU-CVE-2019-2957

Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Security: Encryption. Supported versions that are affected are 8.0.17 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server...

CVE-2019-16383

MOVEit.DMZ.WebApi.dll in Progress MOVEit Transfer 2018 SP2 before 10.2.4, 2019 before 11.0.2, and 2019.1 before 11.1.1 allows an unauthenticated attacker to gain unauthorized access to the database. Depending on the database engine being used MySQL, Microsoft SQL Server, or Azure SQL, an attacker...

CVE-2019-16383

CVE-2019-16383 affects Progress MOVEit Transfer via MOVEit.DMZ.WebApi.dll in MOVEit Transfer 2018 SP2 before 10.2.4, 2019 before 11.0.2, and 2019.1 before 11.1.1. The Red Hat/CIRCL/CNVD entries confirm an unauthenticated SQL injection via the REST API that can cause database access breaches. Affe...

CVE-2019-16177

LimeSurvey prior to 3.17.14 exposes the entire database via browser cache. Affected: LimeSurvey before 3.17.14. Root cause: database content is cached and retrievable from the browser. Impact: potential access to complete data set per the cited advisories. Remediation: upgrade to LimeSurvey 3.17....

Tasking Manager SQL Injection Vulnerability

Tasking Manager is a task management tool for coordinating volunteers and organizations from the OpenStreetMap team. A SQL injection vulnerability exists in Tasking Manager. The vulnerability stems from a lack of validation of externally entered SQL statements in the database-based application. A...

CVE-2019-5633

CVE-2019-5633 concerns insecure storage of sensitive data in Hickory Smart for iOS (Cache.db), enabling potential remote control of locks. Affected: Hickory Smart for iOS, version 01.01.07 and earlier. The connected ThreatPost report notes this CVE alongside related flaws (e.g., 2019-5632, 2019-5...

CVE-2019-4483

IBM Contract Management 10.1.0 through 10.1.3 and IBM Emptoris Spend Analysis 10.1.0 through 10.1.3 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IB...