CVE-2021-32028

A flaw was found in postgresql. Using an INSERT ... ON CONFLICT ... DO UPDATE command on a purpose-crafted table, an authenticated database user could read arbitrary bytes of server memory. The highest threat from this vulnerability is to data confidentiality...

CVE-2021-32028

CVE-2021-32028 affects PostgreSQL families across multiple Linux distributions. A flaw lets an authenticated database user read arbitrary bytes from server memory by abusing an INSERT ... ON CONFLICT ... DO UPDATE on a crafted table, impacting data confidentiality. Public advisories reference aff...

CVE-2021-32028

Removed by vendor...

CVE-2021-32028

A flaw was found in postgresql. Using an INSERT ... ON CONFLICT ... DO UPDATE command on a purpose-crafted table, an authenticated database user could read arbitrary bytes of server memory. The highest threat from this vulnerability is to data confidentiality...

Gurock Testrail 7.2.0.3014 Improper Access Control

Exploit Title: Gurock Testrail 7.2.0.3014 - 'files.md5' Improper Access Control Date: 22/09/2022 Exploit Author: Sick Codes & JohnJHacking Sakura Samuraii Vendor Homepage: https://www.gurock.com/testrail/ Version: 7.2.0.3014 and below Tested on: macOS, Linux, Windows CVE : CVE-2021-40875 Referenc...

The vulnerability of the index.php/appointment/insert_patient_add_appointment component of the Chikitsa Patient Management System allows an attacker to compromise the confidentiality and integrity of the protected information.

The vulnerability of the index.php/appointment/insertpatientaddappointment component of the Chikitsa Patient Management System exists due to the lack of protective measures for the website structure. Exploiting this vulnerability allows an attacker to compromise the confidentiality and integrity ...

CVE-2021-22239

Removed by vendor...

PT-2021-6485 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 14.0 and later Description: The issue is related to the ability of an unauthorized user to insert metadata when creating a new issue. This allows a remote attacker to impact data integrity. Recommendations: For GitLab...

SUSE SLED12 / SLES12 Security Update : mysql-connector-java (SUSE-SU-2021:2877-1)

The remote SUSE Linux SLED12 / SLES12 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2021:2877-1 advisory. - CVE-2020-2875: Unauthenticated attacker with network access via multiple protocols can compromise MySQL Connectors. bsc1173600 -...

Out-of-bounds write in stack

ArrayVec::insert allows insertion of an element into the array object into the specified index. Due to a missing check on the upperbound of this index, it is possible to write out of bounds...

GHSA-R6MV-PPJC-4HGR PHP file inclusion via insert tags

Impact It is possible for untrusted users to load arbitrary PHP files via insert tags. Installations are only affected if there are untrusted back end users. Patches Update to Contao 4.4.56, 4.9.18 or 4.11.7. Workarounds Disable the login for untrusted back end users. References...

YUNUCMS 跨站脚本漏洞

YUNUCMS is a website CMS. A cross-site scripting vulnerability exists in YUNUCMS 1.1.9, which originates from the param parameter in the insertContent function in ContentModel.php...

CVE-2021-37626

Contao is an open source CMS that allows you to create websites and scalable web applications. In affected versions it is possible to load PHP files by entering insert tags in the Contao back end. Installations are only affected if they have untrusted back end users who have the rights to modify...

CVE-2021-37626

Contao is an open source CMS that allows you to create websites and scalable web applications. In affected versions it is possible to load PHP files by entering insert tags in the Contao back end. Installations are only affected if they have untrusted back end users who have the rights to modify...

CVE-2021-37626

Contao is an open source CMS that allows you to create websites and scalable web applications. In affected versions it is possible to load PHP files by entering insert tags in the Contao back end. Installations are only affected if they have untrusted back end users who have the rights to modify...

Code injection

Contao is an open source CMS that allows you to create websites and scalable web applications. In affected versions it is possible to load PHP files by entering insert tags in the Contao back end. Installations are only affected if they have untrusted back end users who have the rights to modify...

PHP file inclusion via insert tags

Date : 2021-08-11 CVE ID : CVE-2021-37626 Description It is possible for untrusted users to load arbitrary PHP files via insert tags. Installations are only affected if there are untrusted back end users. Affected versions Contao 4.0 Contao 4.1 Contao 4.2 Contao 4.3 Contao 4.4 up to 4.4.55 Contao...

CVE-2021-38152

index.php/appointment/insertpatientaddappointment in Chikitsa Patient Management System 2.0.0 allows XSS...

OPENSUSE-SU-2021:1785-1 Security update for postgresql13

This update for postgresql13 fixes the following issues: - Upgrade to version 13.3: - CVE-2021-32027: Fixed integer overflows in array subscripting calculations bsc1185924. - CVE-2021-32028: Fixed mishandling of junk columns in INSERT ... ON CONFLICT ... UPDATE target lists bsc1185925. -...

Security update for postgresql12 (moderate)

openSUSE Security Update: Security update for postgresql12 Announcement ID: openSUSE-SU-2021:1994-1 Rating: moderate References: 1179945 1183118 1183168 1185924 1185925 1185926 Cross-References: CVE-2021-32027 CVE-2021-32028 CVE-2021-32029 CVSS scores: CVE-2021-32027 NVD : 8.8...