Mastodon 注入漏洞

Mastodon is an open source social network server based on ActivityPub. An injection vulnerability exists in Mastodon version 2.5.0 and later versions, which stems from an insecure LDAP query at login. An attacker can exploit this vulnerability to disclose arbitrary attributes of the LDAP database...

Security Bulletin: IBM Security Verify Access Appliance includes components with known vulnerabilities (CVE-2022-29154, CVE-2022-0391)

Summary Multiple Security Vulnerabilities were found in the IBM Security Verify Access ISVA Appliance Operating System layer. These vulnerabilities have been addressed in ISVA 10.0.5.0, which is linked below. Vulnerability Details CVEID:CVE-2022-29154 DESCRIPTION: Rsync could allow a remote...

CVE-2023-28677

The CVE-2023-28677 entry concerns the Jenkins Convert To Pipeline Plugin (1.0 and earlier). The vulnerability arises from using basic string concatenation to convert Freestyle projects’ Build Environment, Build Steps, and Post-build Actions into Pipeline invocations, enabling an attacker who can ...

Online Pizza Ordering System SQL注入漏洞

Online Pizza Ordering System is an online pizza ordering system by Carlo Montero, an individual developer. A security vulnerability exists in Online Pizza Ordering System version 1.0, which is caused by a SQL injection vulnerability via the id parameter in /admin/vieworder.php...

Debian: Security Advisory (DLA-745-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2023-25432

An issue was discovered in Online Reviewer Management System v1.0. There is a SQL injection that can directly issue instructions to the background database system via reviewer0/admins/assessments/course/course-update.php...

Input validation

Due to improper parameter filtering in the sequalize js library, can a attacker peform injection...

CVE-2023-22579 Sequalize - Unsafe fall-through in getWhereConditions

Due to improper parameter filtering in the sequalize js library, can a attacker peform injection...

SUSE CVE-2005-2301

PowerDNS before 2.9.18, when running with an LDAP backend, does not properly escape LDAP queries, which allows remote attackers to cause a denial of service failure to answer ldap questions and possibly conduct an LDAP injection attack...

SUSE CVE-2013-6172

steps/utils/savepref.inc in Roundcube webmail before 0.8.7 and 0.9.x before 0.9.5 allows remote attackers to modify configuration settings via the session parameter, which can be leveraged to read arbitrary files, conduct SQL injection attacks, and execute arbitrary code...

SUSE CVE-2020-7471

Django 1.11 before 1.11.28, 2.2 before 2.2.10, and 3.0 before 3.0.3 allows SQL Injection if untrusted data is used as a StringAgg delimiter e.g., in Django applications that offer downloads of data as a series of rows with a user-specified column delimiter. By passing a suitably crafted delimiter...

GHSA-6P5Q-H963-PWWF Apache AGE: Python and Golang drivers allow data manipulation and exposure due to SQL injection

There are issues with the AGE drivers for Golang and Python that enable SQL injections to occur. This impacts AGE for PostgreSQL 11 & AGE for PostgreSQL 12, all versions up-to-and-including 1.1.0, when using those drivers. The fix is to update to the latest Golang and Python drivers in addition t...

PT-2023-16436 · Unknown · Calendar Event Management System

Name of the Vulnerable Software and Affected Versions: Calendar Event Management System version 2.3.0 Description: A critical issue affects the Login Page component of the system, where the manipulation of the name and pwd arguments leads to SQL injection. The attack can be initiated remotely...

U.S. Department of State: HTML INJECTION on coins.state.gov

An HTML injection vulnerability was found on coins.state.gov, which could have allowed an attacker to modify the page and potentially steal a user's identity. The vulnerability was discovered through the use of the dalfox tool...

PT-2023-10625 · Bastianallgeier · Bastianallgeier Kirby Webmentions Plugin

Name of the Vulnerable Software and Affected Versions: bastianallgeier Kirby Webmentions Plugin affected versions not specified Description: A vulnerability was found in the bastianallgeier Kirby Webmentions Plugin, allowing for injection attacks. The manipulation can be launched remotely, but th...

CVE-2022-46623

Judging Management System v1.0.0 was discovered to contain a SQL injection vulnerability via the username parameter...

Voyager SQL注入漏洞

Voyager is an application by David Borland, an individual developer. Voyager suffers from a SQL injection vulnerability. An attacker could exploit this vulnerability to perform a sql injection attack...

Address Book SQL注入漏洞

Address Book is an address table with an activity log. A SQL injection vulnerability exists in LearnMeSomeCodes Address Book. An attacker could use this vulnerability to perform a sql injection attack...

CVE-2022-43531

Vulnerabilities in the web-based management interface of ClearPass Policy Manager could allow an authenticated remote attacker to conduct SQL injection attacks against the ClearPass Policy Manager instance. An attacker could exploit these vulnerabilities to obtain and modify sensitive information...

CVE-2022-43522

Multiple vulnerabilities in the web-based management interface of Aruba EdgeConnect Enterprise Orchestrator could allow an authenticated remote attacker to conduct SQL injection attacks against the Aruba EdgeConnect Enterprise Orchestrator instance. An attacker could exploit these vulnerabilities...