IBM DB2 power lifting vulnerability (CNVD-2018-13458)

IBM DB2 is a set of relational database management system from IBM in the United States. The main execution environments for this system are UNIX, Linux, IBM i, z/OS, and Windows server versions. An untrustworthy search path vulnerability exists in IBM DB2 including DB2 Connect Server based on...

CVE-2018-12912

An issue wan discovered in admin\controllers\database.php in HongCMS 3.0.0. There is a SQL Injection vulnerability via an admin/index.php/database/operate?dbaction=emptytable&tablename= URI...

Wecodex Store Paypal SQL Injection Vulnerability

Wecodex Store Paypal is a management system. A SQL injection vulnerability exists in Wecodex Store Paypal. An attacker can exploit the vulnerability to obtain sensitive information...

SQL Injection Vulnerability in PHP Multilingual Version V2.7 of SEMCMS Foreign Trade Web Site

SemCms is a set of open source foreign trade enterprise website management system, mainly used for foreign trade enterprises, compatible with IE, Firefox and other mainstream browsers.SemCms using php and vb language writing, combined with apache or iis running. SEMCMS foreign trade website PHP...

Information disclosure

ipip is a Node.js module to query geolocation information for an IP or domain, based on database by ipip.net. ipip downloads data resources over HTTP, which leaves it vulnerable to MITM attacks...

CVE-2004-0331

creationtimestamp| type| source ---|---|--- 2018-05-29 15:50:33+00:00| seen| https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/dos/http/dellopenmanagepost.rb 2025-02-06 03:13:37+00:00| seen| MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd 2025-02-23 04:08:07+00:00| seen|...

Vanilla: A SQL injection vulnerability in Vanilla

Summary: There is a SQL injection vulnerability in the vanilla, an attacker can use this vulnerability to obtain database information. Description: in applications/conversations/controllers/class.messagescontroller.php:164 php public function addMessage$conversationID = ''...

CVE-2018-6409

An issue was discovered in Appnitro MachForm before 4.2.3. The module in charge of serving stored files gets the path from the database. Modifying the name of the file to serve on the corresponding apform table leads to a path traversal vulnerability via the download.php q parameter...

PHP Dashboards 4.5 - SQL Injection

Exploit Title: PHP Dashboards 4.5 - SQL Injection Dork: N/A Date: 2018-05-23 Exploit Author: Özkan Mustafa Akkuş AkkuS Vendor Homepage: https://codecanyon.net/item/php-dashboards-v50-brand-new-enterprise-edition/21540104 Version: v4.5 Category: Webapps Tested on: Kali linux Description: PHP...

SQL Injection

Overview All versions of query-mysql are vulnerable to SQL injection due to lack of user input sanitization allows to run arbitrary SQL queries when fetching data from database. Recommendation No fix is currently available for this vulnerability. It is our recommendation to not install or use thi...

CVE-2018-1115

postgresql before versions 10.4, 9.6.9 is vulnerable in the adminpack extension, the pgcatalog.pglogfilerotate function doesn't follow the same ACLs than pgroratelogfile. If the adminpack is added to a database, an attacker able to connect to it could exploit this to force log rotation...

Remote Memory Exposure

Overview Versions of mongoose before 4.3.6, 3.8.39 are vulnerable to remote memory exposure. Trying to save a number to a field of type Buffer on the affected mongoose versions allocates a chunk of uninitialized memory and stores it in the database. Recommendation Update to version 4.3.6, 3.8.39 ...

CVE-2017-9656

The backend database of the Philips DoseWise Portal application versions 1.1.7.333 and 2.1.1.3069 uses hard-coded credentials for a database account with privileges that can affect confidentiality, integrity, and availability of the database. For an attacker to exploit this vulnerability, elevate...

CVE-2017-9656

This CVE (CVE-2017-9656) affects Philips DoseWise Portal (DWP) Backend DB credentials in versions 1.1.7.333 and 2.1.1.3069. The root cause is hard-coded credentials in backend system files, granting a database account with privileges that can affect confidentiality, integrity, and availability. E...

CVE-2017-2825

CVE-2017-2825 affects Zabbix Server 2.4.x in the trapper functionality. Specifically crafted trapper packets can bypass database logic checks, leading to unauthorized database writes. An attacker could leverage a MitM position to modify trapper requests between an active Zabbix proxy and the Serv...

Zoho ManageEngine Desktop Central Database Query Type Restriction Under-Execution Vulnerability

ZOHO ManageEngine Desktop Central DC is a desktop management solution from ZOHO. The solution includes software distribution, patch management, system configuration, remote control and other functional modules to support the entire lifecycle of desktop and server management. A security...

Unspecified Vulnerability in Oracle Supply Chain Products Suite (CNVD-2018-09090)

Oracle Supply Chain Products Suite is the United States Oracle Oracle company's set of supply chain solutions, the program provides value chain planning, value chain execution, product lifecycle management and other functions. An unspecified vulnerability exists in the Database component of Oracl...

CVE-2018-0532

Cybozu Garoon 3.0.0 to 4.2.6 allows remote authenticated attackers to bypass access restriction to alter setting data of the Standard database via unspecified vectors...

The vulnerability in the `track_import_export.php` script of the U.motion builder system allows a perpetrator to execute arbitrary SQL queries against the database.

The vulnerability of the trackimportexport.php script of the U.motion builder system, a system for managing industrial and residential buildings, is related to the lack of measures taken to protect the SQL query structure. Exploiting this vulnerability allows an attacker to execute arbitrary SQL...

IBM DB2 GSKit Denial of Service Vulnerability

IBM DB2 is a set of relational database management system of American IBM Company. The system is implemented in UNIX, Linux, IBM i, z/OS, and Windows server versions.GSKit is one of a set of security management tools for IBM products. A security vulnerability exists in GSKit in IBM DB2. A local...