CVE-2019-13373

An issue was discovered in the D-Link Central WiFi Manager CWM100 before v1.03R0100BETA6. Input does not get validated and arbitrary SQL statements can be executed in the database via the /web/Public/Conn.php parameter dbSQL...

CVE-2019-7260

Linear eMerge E3-Series devices have Cleartext Credentials in a Database...

Joomla! AMGallery Component SQL Injection Vulnerability

Joomla! is a U.S. Open Source Matters team using PHP and MySQL development of a set of open source , cross-platform content management system CMS. AMGallery is used in which a picture display component . A SQL injection vulnerability exists in the AMGallery component of Joomla! An attacker can...

MongoDB 4.2 Introduces End-to-End Field Level Encryption for Databases

At its developer conference held earlier this week in New York, the MongoDB team announced the latest version of its database management software that includes a variety of advanced features, including Field Level Encryption, Distributed Transactions, and Wildcard Indexes. The newly introduced...

MongoDB 4.2 Introduces End-to-End Field Level Encryption for Databases

At its developer conference held earlier this week in New York, the MongoDB team announced the latest version of its database management software that includes a variety of advanced features, including Field Level Encryption, Distributed Transactions, and Wildcard Indexes. The newly introduced...

Design/Logic Flaw

Insufficient password protection in the attestation database for Open CIT may allow an authenticated user to potentially enable information disclosure via local access...

NoSQL Injection in loopback-connector-mongodb

Versions of loopback-connector-mongodb before 3.6.0 are vulnerable to NoSQL injection. MongoDB Connector for LoopBack fails to properly sanitize a filter passed to query the database by allowing the dangerous $where property to be passed to the MongoDB Driver. The Driver allows the special $where...

Sql injection

The Quest Kace K1000 Appliance, versions prior to 9.0.270, allows an authenticated, remote attacker with least privileges 'User Console Only' role to potentially exploit multiple Blind SQL Injection vulnerabilities to retrieve sensitive information from the database or copy the entire database. A...

Modern Database Security Buys Down More Risks for Enterprises

Pop quiz: how many data records are lost or stolen on an average day? 1 million? 3 million? 6 million? If you answered 6 million, you’re correct, according to the Breach Level Index. According to the Index, 14.7 billion records have been lost or stolen since 2013, or more than 2.2 billion per yea...

CVE-2019-11619

CVE-2019-11619 : Multiple connected sources confirm a SQL injection in doorGets 7.0, specifically in /doorgets/app/requests/user/configurationRequest.php when action=analytics. The vulnerability allows a remote backend administrator (or a user with permission to manage configuration analytics) to...

Casino Goes All In and Wins Big with Imperva Security

There’s no good time to be hit by ransom-seeking DDoS attackers. For one casino-entertainment provider, the timing was particularly bad — right before one of its largest online poker events in 2016. The casino, which generates multiple billions in revenue per year, leveraged Imperva’s emergency...

CVE-2019-4012

IBM BigFix WebUI Profile Management 6 and Software Distribution 23 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID: 155886...

CVE-2019-7139

An unauthenticated SQL injection vulnerability exists in Magento due to insufficient validation of externally entered SQL statements, specifically a failure to properly sanitize user-supplied 'from' and 'to' inputs in the prepareSqlCondition function of the ` MagentoFrameworkDBAdapterPdoMysql cla...

Location data leaks from family tracking app database

An app called Family Locator, which allows family members to keep track of one another recently experienced an exposed database issue of the worst kind. Specifically: the MongoDB database was left exposed with no password, like so many other recent infosec tales of woe. The end result is the...

CVE-2018-18254

CVE-2018-18254 affects CapMon Access Manager 5.4.1.1005. An unprivileged user can read the CAL (Custom App Launcher) database table cal_whitelist, enabling potential privilege escalation by placing a Trojan horse program at an app pathname. Root cause is access to sensitive CAL data leading to el...

CVE-2019-3615 Data Leakage Vulnerability in McAfee Database Security web interface

Data Leakage Attacks vulnerability in the web interface in McAfee Database Security prior to the 4.6.6 March 2019 update allows local users to expose passwords via incorrectly auto completing password fields in the admin browser login screen...

CVE-2019-3615

CVE-2019-3615 affects the web interface of McAfee Database Security prior to version 4.6.6 (March 2019). The issue allows local users to exfiltrate passwords by exploiting incorrectly autofilled password fields on the admin login screen. Impact is described in NT terms as exposure of passwords an...

CVE-2019-3615

Data Leakage Attacks vulnerability in the web interface in McAfee Database Security prior to the 4.6.6 March 2019 update allows local users to expose passwords via incorrectly auto completing password fields in the admin browser login screen...

CVE-2019-3615

Data Leakage Attacks vulnerability in the web interface in McAfee Database Security prior to the 4.6.6 March 2019 update allows local users to expose passwords via incorrectly auto completing password fields in the admin browser login screen...

Code injection

Data Leakage Attacks vulnerability in the web interface in McAfee Database Security prior to the 4.6.6 March 2019 update allows local users to expose passwords via incorrectly auto completing password fields in the admin browser login screen...