Jackalope Doctrine-DBAL SQL注入漏洞

Jackalope Doctrine-DBAL is an implementation of the PHP Content Repository API PHPCR that uses a relational database to persist data. Jackalope Doctrine-DBAL suffers from a SQL injection vulnerability that stems from the software's lack of effective filtering for the $property parameter. In the...

CVE-2021-43608

Doctrine DBAL 3.x before 3.1.4 allows SQL Injection. The escaping of offset and length inputs to the generation of a LIMIT clause was not probably cast to an integer, allowing SQL injection to take place if application developers passed unescaped user input to the DBAL QueryBuilder or any other A...

CVE-2021-43608

Doctrine DBAL 3.x before 3.1.4 allows SQL Injection. The escaping of offset and length inputs to the generation of a LIMIT clause was not probably cast to an integer, allowing SQL injection to take place if application developers passed unescaped user input to the DBAL QueryBuilder or any other A...

Sql injection

Doctrine DBAL 3.x before 3.1.4 allows SQL Injection. The escaping of offset and length inputs to the generation of a LIMIT clause was not probably cast to an integer, allowing SQL injection to take place if application developers passed unescaped user input to the DBAL QueryBuilder or any other A...

CVE-2021-43608

Doctrine DBAL 3.x before 3.1.4 allows SQL Injection. The escaping of offset and length inputs to the generation of a LIMIT clause was not probably cast to an integer, allowing SQL injection to take place if application developers passed unescaped user input to the DBAL QueryBuilder or any other A...

CVE-2021-43608

Doctrine DBAL 3.x before 3.1.4 allows SQL Injection. The escaping of offset and length inputs to the generation of a LIMIT clause was not probably cast to an integer, allowing SQL injection to take place if application developers passed unescaped user input to the DBAL QueryBuilder or any other A...

CVE-2021-43608

Doctrine DBAL 3.x before 3.1.4 is affected by a SQL injection in the LIMIT clause generation. The root cause is that offset and length inputs used to build LIMIT are not reliably cast to integers, which allows injection when unescaped user input is passed to the DBAL QueryBuilder or APIs that cal...

CVE-2021-43608

Doctrine DBAL 3.x before 3.1.4 allows SQL Injection. The escaping of offset and length inputs to the generation of a LIMIT clause was not probably cast to an integer, allowing SQL injection to take place if application developers passed unescaped user input to the DBAL QueryBuilder or any other A...

SQL Injection

doctrine/dbal is vulnerable to SQL injection. The modifyLimitQuery function in src/Platforms/AbstractPlatform.php does not properly sanitize the input, which allows a remote attacker to inject arbitrary SQL commands to the APIs...

GHSA-R7CJ-8HJG-X622 DBAL 3 SQL Injection Security Vulnerability

We have released a new version Doctrine DBAL 3.1.4 that fixes a critical SQL injection vulnerability in the LIMIT clause generation API provided by the Platform abstraction. We advise everyone using Doctrine DBAL 3.0.0 up to 3.1.3 to upgrade to 3.1.4 immediately. The vulnerability can happen when...

DBAL 3 SQL Injection Security Vulnerability

We have released a new version Doctrine DBAL 3.1.4 that fixes a critical SQL injection vulnerability in the LIMIT clause generation API provided by the Platform abstraction. We advise everyone using Doctrine DBAL 3.0.0 up to 3.1.3 to upgrade to 3.1.4 immediately. The vulnerability can happen when...

SQL Injection in Limit Clause Generation API

We have released a new version Doctrine DBAL 3.1.4 that fixes a critical SQL injection vulnerability in the LIMIT clause generation API provided by the Platform abstraction. We advise everyone using Doctrine DBAL 3.0.0 up to 3.1.3 to upgrade to 3.1.4 immediately. The vulnerability can happen when...

Nextcloud: SQL injextion via vulnerable doctrine/dbal version

Summary: SQL injection via limit parameter on user facing APIs Steps To Reproduce: Run security scanner: 1. REPORT /remote.php/dav/comments/files/1985 1. XML input oc:filter-comments.oc:limittext was set to 1'" 1. You have an error in your SQL syntax Supporting Material/References: For more detai...

SQL Injection in dbal

More info at https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2015-016/...

SQL Injection in dbal

It has been discovered, that TYPO3 is susceptible to SQL Injection Component Type: TYPO3 CMS Release Date: February 16, 2016 Vulnerable subcomponent: Dbal Vulnerability Type: SQL Injection Affected Versions: Versions 6.2.0 to 6.2.17 Severity: High Suggested CVSS v2.0:...

[SECURITY] Fedora 23 Update: php-doctrine-doctrine-bundle-1.5.2-1.fc23

Doctrine DBAL & ORM Bundle for the Symfony Framework. Optional: Doctrine ORM 2.3 =3D php-doctrine-orm 3.0 Symfony Web Profile Bundle 2.3 =3D php-symfony-web-profiler-bundle 4. 0 Twig 1.10 =3D php-twig 2.0...

[SECURITY] Fedora 22 Update: php-doctrine-doctrine-bundle-1.5.2-1.fc22

Doctrine DBAL & ORM Bundle for the Symfony Framework. Optional: Doctrine ORM 2.3 =3D php-doctrine-orm 3.0 Symfony Web Profile Bundle 2.3 =3D php-symfony-web-profiler-bundle 4. 0 Twig 1.10 =3D php-twig 2.0...

[SECURITY] Fedora 21 Update: php-doctrine-doctrine-bundle-1.5.2-1.fc21

Doctrine DBAL & ORM Bundle for the Symfony Framework. Optional: Doctrine ORM 2.3 =3D php-doctrine-orm 3.0 Symfony Web Profile Bundle 2.3 =3D php-symfony-web-profiler-bundle 4. 0 Twig 1.10 =3D php-twig 2.0...

CVE-2011-1522

Multiple SQL injection vulnerabilities in the Doctrine\DBAL\Platforms\AbstractPlatform::modifyLimitQuery function in Doctrine 1.x before 1.2.4 and 2.x before 2.0.3 allow remote attackers to execute arbitrary SQL commands via the 1 limit or 2 offset field...

DEBIAN-CVE-2011-1522

Multiple SQL injection vulnerabilities in the Doctrine\DBAL\Platforms\AbstractPlatform::modifyLimitQuery function in Doctrine 1.x before 1.2.4 and 2.x before 2.0.3 allow remote attackers to execute arbitrary SQL commands via the 1 limit or 2 offset field...