39 matches found
CVE-2026-104956
Plane is an open-source project management tool. Prior to 1.4.0, the unauthenticated public issues endpoint accepts groupby and subgroupby query parameters and passes them without an allowlist to grouped paginators, where they are used as ORM field names by Ffield, .valuesfield, .orderbyfield, an...
CVE-2026-104956
The open-source project management tool Plane is vulnerable to unauthenticated ORM field-name injection in versions prior to 1.4.0 . The public issues endpoint fails to validate the group_by and sub_group_by query parameters, passing them directly to grouped paginators. Attackers can supply arbit...
CVE-2026-104956 Plane: Unauthenticated ORM field-name injection via `group_by`/`sub_group_by` on public deploy boards (DoS + blind oracle)
Plane is an open-source project management tool. Prior to 1.4.0, the unauthenticated public issues endpoint accepts groupby and subgroupby query parameters and passes them without an allowlist to grouped paginators, where they are used as ORM field names by Ffield, .valuesfield, .orderbyfield, an...
CVE-2026-104956 Plane: Unauthenticated ORM field-name injection via `group_by`/`sub_group_by` on public deploy boards (DoS + blind oracle)
Plane is an open-source project management tool. Prior to 1.4.0, the unauthenticated public issues endpoint accepts groupby and subgroupby query parameters and passes them without an allowlist to grouped paginators, where they are used as ORM field names by Ffield, .valuesfield, .orderbyfield, an...
CVE-2026-104956 Plane: Unauthenticated ORM field-name injection via `group_by`/`sub_group_by` on public deploy boards (DoS + blind oracle)
Plane is an open-source project management tool. Prior to 1.4.0, the unauthenticated public issues endpoint accepts groupby and subgroupby query parameters and passes them without an allowlist to grouped paginators, where they are used as ORM field names by Ffield, .valuesfield, .orderbyfield, an...
EUVD-2026-92480
Plane is an open-source project management tool. Prior to 1.4.0, the unauthenticated public issues endpoint accepts groupby and subgroupby query parameters and passes them without an allowlist to grouped paginators, where they are used as ORM field names by Ffield, .valuesfield, .orderbyfield, an...
CVE-2026-104956: Improper Neutralization of Special Elements in Data Query Logic
Plane is an open-source project management tool. Prior to 1.4.0, the unauthenticated public issues endpoint accepts groupby and subgroupby query parameters and passes them without an allowlist to grouped paginators, where they are used as ORM field names by Ffield, .valuesfield, .orderbyfield, an...
Rocky Linux 8 [CIQ] Security Update: python-nose-docs / python3-PyMySQL / python3-docs / etc Multiple Vulnerabilities (crlsa-2019_0984)
The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20190984 advisory. python-sqlalchemy: SQL Injection when the orderby parameter can be controlled CVE-2019-7164 python-sqlalchemy: SQL Injection when the groupby parameter can...
Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: python-sqlalchemy (UTSA-2026-090396)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-090396 advisory. SQLAlchemy 1.2.17 has SQL Injection when the groupby parameter can be controlled. Tenable has extracted the preceding description block directly from the Unity Linux...
EUVD-2019-18433
Malware in sbrugna...
EUVD-2019-0134
Malware in sbrugna...
CVE-2025-56381
ERPNEXT v15.67.0 was discovered to contain multiple SQL injection vulnerabilities in the /api/method/frappe.desk.reportview.get endpoint via the orderby and groupby parameters...
CVE-2025-56381: Improper Neutralization of Special Elements used in an SQL Command
ERPNEXT v15.67.0 was discovered to contain multiple SQL injection vulnerabilities in the /api/method/frappe.desk.reportview.get endpoint via the orderby and groupby parameters...
EulerOS 2.0 SP2 : python-sqlalchemy (EulerOS-SA-2020-2391)
According to the version of the python-sqlalchemy package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - SQLAlchemy 1.2.17 has SQL Injection when the groupby parameter can be controlled.CVE-2019-7548 Note that Tenable Network Security has...
CVE-2019-7548
SQLAlchemy 1.2.17 has SQL Injection when the groupby parameter can be controlled...
Updated python-sqlalchemy packages fix security vulnerabilities
Updated python-sqlalchemy packages fix security vulnerabilities: SQL Injection via the orderby parameter CVE-2019-7164. SQL Injection via the groupby parameter CVE-2019-7548...
MGASA-2019-0350 Updated python-sqlalchemy packages fix security vulnerabilities
Updated python-sqlalchemy packages fix security vulnerabilities: SQL Injection via the orderby parameter CVE-2019-7164. SQL Injection via the groupby parameter CVE-2019-7548...
SUSE SLED15 / SLES15 Security Update : python-SQLAlchemy (SUSE-SU-2019:2253-1)
This update for python-SQLAlchemy fixes the following issues : Security issues fixed : CVE-2019-7164: Fixed SQL Injection via the orderby parameter bsc1124593. CVE-2019-7548: Fixed SQL Injection via the groupby parameter bsc1124593. Note that Tenable Network Security has extracted the preceding...
Important: Red Hat Security Advisory: python27:2.7 security update
An update for the python27:2.7 module is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...
