JVN#78501037: Movable Type plugin A-Member and A-Reserve vulnerable to SQL injection

A-Member and A-Reserve provided by ARK-Web co., ltd. are plugins for Movable Type which provide functions to build a membership website or a reservation website. A-Member and A-Reserve contain SQL injection CWE-89 vulnerability due to the issue in processing cookie values. Impact An attacker who...

CVE-2017-16961

A SQL injection vulnerability in core/inc/auto-modules.php in BigTree CMS through 4.2.19 allows remote authenticated attackers to obtain information in the context of the user used by the application to retrieve data from the database. The attack uses an admin/trees/add/process request with a...

CVE-2017-16961

BigTree CMS 4.2.19 and earlier is affected by a SQL injection in core/inc/auto-modules.php. An attacker who is authenticated can exploit a crafted _tags[] parameter in admin/trees/add/process, with the issue later mishandled in admin/ajax/dashboard/approve-change, to obtain information in the con...

USN-3489-1 db5.3 vulnerability

It was discovered that Berkeley DB incorrectly handled certain configuration files. An attacker could possibly use this issue to read sensitive information...

Sql injection

A vulnerability in the Cisco Unified Communications Manager SQL database interface could allow an authenticated, remote attacker to impact the confidentiality of the system by executing arbitrary SQL queries, aka SQL Injection. The vulnerability is due to a lack of input validation on user-suppli...

The vulnerability of the IBM DB2 database management system and the IBM DB2 Connect Server automatic redirection server allows a perpetrator to gain access with root privileges.

The vulnerability of the IBM DB2 database management system and the IBM DB2 Connect Server automatic redirection server is related to deficiencies in access control. Exploiting this vulnerability could allow a perpetrator with privileges as the local owner of a DB2 instance to gain access with ro...

CVE-2017-12618

Apache Portable Runtime Utility APR-util 1.6.0 and prior fail to validate the integrity of SDBM database files used by aprsdbm functions, resulting in a possible out of bound read access. A local user with write access to the database can make a program or process using these functions crash, and...

mysql: C API unspecified vulnerability (CPU Jul 2017)

Vulnerability in the MySQL Server component of Oracle MySQL subcomponent: C API. Supported versions that are affected are 5.7.18 and earlier. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server. Successful attack...

The vulnerability of the software of Siemens SICAM PAS systems for power management and control involves insufficient protection of passwords in the databases, allowing attackers to calculate the passwords.

The vulnerability of the software in Siemens SICAM PAS systems for telecontrol and telemanagement is related to insufficient protection of passwords in the databases. Exploiting this vulnerability allows a malicious actor, operating locally, to calculate the passwords using certain privileges...

Shaanxi Knight Technology Development Co., Ltd. enterprise station building system has SQL injection vulnerability

Ltd. is a website design company with website construction and visual design development and brand online marketing promotion. Ltd. corporate website building system suffers from SQL injection vulnerability, which can be exploited by attackers to obtain sensitive information from the database...

The vulnerability of IBM DB2 database management systems, including IBM DB2 Connect (and IBM DB2 Connect servers), is related to deficiencies in access control. This allows attackers to obtain elevated privileges.

The vulnerabilities of IBM DB2 database management systems, including IBM DB2 Connect and the IBM DB2 Connect server, are related to deficiencies in access control. Exploiting these vulnerabilities can allow an attacker, operating locally, to gain elevated privileges and re-record DB2-formatted...

IBM DB2 Security Bypass Vulnerability

IBM DB2 is a set of relational database management system from IBM in the United States. The main execution environments for this system are UNIX, Linux, IBM i, z/OS, and Windows server versions. A security vulnerability exists in IBM DB2. An attacker can exploit the vulnerability to activate the...

CVE-2017-1452

IBM DB2 for Linux, UNIX and Windows 9.7, 10,1, 10.5, and 11.1 includes DB2 Connect Server could allow a local user to obtain elevated privilege and overwrite DB2 files. IBM X-Force ID: 128180...

CVE-2014-8677

The installation process for SOPlanning 1.32 and earlier allows remote authenticated users with a prepared database, and access to an existing database with a crafted name, or permissions to create arbitrary databases, or if PHP before 5.2 is being used, the configuration database is down, and...

CVE-2014-8677

SO Planning (SOPlanning) 1.32 and earlier is vulnerable to multiple issues, including SQL injection, XSS and PHP code injection. Specifically, CVE-2014-8677 describes that remote authenticated users with a prepared database or the ability to create arbitrary databases, or PHP < 5.2 with an con...

Command Execution Vulnerability in Xinqi Online Learning System /ajax/GetForm.ashx Page

Online Learning System is an e-learning platform system developed in . A command execution vulnerability exists in the /ajax/GetForm.ashx page of Xinqi Online Learning System. An attacker can exploit this vulnerability to execute arbitrary SQL statements...

Yunnan Dandelion Network Technology Co., Ltd. website building system has SQL injection vulnerabilities

Yunnan Dandelion Network Technology Co., Ltd. is a station building system. A SQL injection vulnerability exists in Yunnan Dandelion Network Technology Co. The vulnerability is due to the system id parameter does not filter the data submitted by the user, a remote attacker can exploit the...

SQL Injection Vulnerability in the Latest Version of YxtCMF

YxtCMF online learning system is an online learning platform system developed with thinkphp+bootstrap as the framework. The latest version of YxtCMF has a SQL injection vulnerability, which is exploited by attackers to obtain database sensitive information...

PostgreSQL Security Bypass Vulnerability (CNVD-2017-26577)

PostgreSQL is a free object-relational database management system developed by the PostgreSQL development group. The system supports most of the SQL standards and provides many other features, such as foreign keys, triggers, views, and so on. A security bypass vulnerability exists in PostgreSQL. ...

CVE-2017-6757

A vulnerability in Cisco Unified Communications Manager 10.52.10000.5, 11.01.10000.10, and 11.51.10000.6 could allow an authenticated, remote attacker to conduct a blind SQL injection attack. The vulnerability is due to a failure to validate user-supplied input used in SQL queries that bypass...