137763 matches found
CVE-2026-69240 Sequelize: SQL Injection (Oracle DB)
Sequelize is a Node.js ORM tool. Prior to 6.37.4, SQL injection is possible with strings only if dialect is set to oracle. The escape function defined in sql-string.js does not escape quotes if the value starts with TOTIMESTAMP or TODATE. In the Oracle dialect, when val is a string and starts wit...
CVE-2026-69240
Summary: CVE-2026-69240 affects Sequelize (Node.js ORM). Before 6.37.4, the Oracle dialect may be vulnerable to SQL injection when strings reach the escape path in sql-string.js: if a string value starts with TO_TIMESTAMP or TO_DATE, quotes are not escaped, returning the string unmodified. This a...
CVE-2026-69240
Sequelize is a Node.js ORM tool. Prior to 6.37.4, SQL injection is possible with strings only if dialect is set to oracle. The escape function defined in sql-string.js does not escape quotes if the value starts with TOTIMESTAMP or TODATE. In the Oracle dialect, when val is a string and starts wit...
EUVD-2026-52429
Sequelize is a Node.js ORM tool. Prior to 6.37.4, SQL injection is possible with strings only if dialect is set to oracle. The escape function defined in sql-string.js does not escape quotes if the value starts with TOTIMESTAMP or TODATE. In the Oracle dialect, when val is a string and starts wit...
CVE-2026-69240 Sequelize: SQL Injection (Oracle DB)
Sequelize is a Node.js ORM tool. Prior to 6.37.4, SQL injection is possible with strings only if dialect is set to oracle. The escape function defined in sql-string.js does not escape quotes if the value starts with TOTIMESTAMP or TODATE. In the Oracle dialect, when val is a string and starts wit...
JLSEC-2026-1140 Issue summary: The CMS_decrypt and PKCS7_decrypt functions are vulnerable to Bleichenbacher-style...
Issue summary: The CMSdecrypt and PKCS7decrypt functions are vulnerable to Bleichenbacher-style attack when an attacker is able to provide the CMS or S/MIME messages and observe the error code and/or decryption output. Impact summary: The Bleichenbacher-style attack allows an attacker to use the...
Duplicate Advisory: SiYuan: Cross-boundary content disclosure via getBacklinkDoc/getBackmentionDoc (publish mode): reader-reachable rendered DOM of publish-forbidden docs; sibling list endpoints are filtered
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-36v8-mpjm-8j5r. This link is maintained to preserve external references. Original Description SiYuan before v3.7.3 fails to apply publish-access filters to the getBacklinkDoc and getBackmentionDoc content...
GHSA-2MMH-4RF8-7XG6 Duplicate Advisory: SiYuan: Cross-boundary content disclosure via getBacklinkDoc/getBackmentionDoc (publish mode): reader-reachable rendered DOM of publish-forbidden docs; sibling list endpoints are filtered
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-36v8-mpjm-8j5r. This link is maintained to preserve external references. Original Description SiYuan before v3.7.3 fails to apply publish-access filters to the getBacklinkDoc and getBackmentionDoc content...
WordPress Quiz and Survey Master (QSM) plugin < 11.1.3 - Unauthenticated User Enumeration and Password Oracle vulnerability
Unauthenticated User Enumeration and Password Oracle vulnerability discovered by Ahmad Mubarak Alanazi in WordPress Plugin Quiz And Survey Master versions 11.1.3...
Improper Validation of Integrity Check Value
Overview Affected versions of this package are vulnerable to Improper Validation of Integrity Check Value in the processPacket method of KCCMBlockCipher, which invokes processAAD only when associated data is present, so with no AAD the G1 block nonce, length, flag is never mixed into the MAC and...
Improper Validation of Integrity Check Value
Overview Affected versions of this package are vulnerable to Improper Validation of Integrity Check Value in the processPacket method of KCCMBlockCipher, which invokes processAAD only when associated data is present, so with no AAD the G1 block nonce, length, flag is never mixed into the MAC and...
Improper Validation of Integrity Check Value
Overview Affected versions of this package are vulnerable to Improper Validation of Integrity Check Value in the processPacket method of KCCMBlockCipher, which invokes processAAD only when associated data is present, so with no AAD the G1 block nonce, length, flag is never mixed into the MAC and...
Improper Validation of Integrity Check Value
Overview org.bouncycastle:bcprov-ext-jdk14 is a Java implementation of cryptographic algorithms. Affected versions of this package are vulnerable to Improper Validation of Integrity Check Value in the processPacket method of KCCMBlockCipher, which invokes processAAD only when associated data is...
Improper Validation of Integrity Check Value
Overview org.bouncycastle:bcprov-jdk14 is a Java implementation of cryptographic algorithms. Affected versions of this package are vulnerable to Improper Validation of Integrity Check Value in the processPacket method of KCCMBlockCipher, which invokes processAAD only when associated data is...
Improper Validation of Integrity Check Value
Overview Affected versions of this package are vulnerable to Improper Validation of Integrity Check Value in the processPacket method of KCCMBlockCipher, which invokes processAAD only when associated data is present, so with no AAD the G1 block nonce, length, flag is never mixed into the MAC and...
Improper Validation of Integrity Check Value
Overview org.bouncycastle:bcprov-jdk15on is a Java implementation of cryptographic algorithms. Affected versions of this package are vulnerable to Improper Validation of Integrity Check Value in the processPacket method of KCCMBlockCipher, which invokes processAAD only when associated data is...
Improper Validation of Integrity Check Value
Overview Affected versions of this package are vulnerable to Improper Validation of Integrity Check Value in the processPacket method of KCCMBlockCipher, which invokes processAAD only when associated data is present, so with no AAD the G1 block nonce, length, flag is never mixed into the MAC and...
Security Bulletin: IBM Storage Protect Data Protection for Virtual Environments incorporates Oracle's January 2026 Critical Patch Update (CPU) to fix multiple security vulnerabilities (CVE-2026-21945, CVE-2026-21932, CVE-2026-21933, CVE-2026-21925)
Summary IBM Storage Protect Data Protection for Virtual Environments incoprporates the security fixes related to Oracle's January 2026 Critical Patch Update CPU. The IBM SDK, Java Technology Edition Critical Patch Update CPU bundles several security updates from Oracle to address multiple...
Exposure of Sensitive Information Through Metadata
Overview Affected versions of this package are vulnerable to Exposure of Sensitive Information Through Metadata via CFB quick-check decryption oracle in the getDataStream method of PGPSymmetricKeyEncryptedData, reached through PGPPBEEncryptedData, PGPSessionKeyEncryptedData, and...
Exposure of Sensitive Information Through Metadata
Overview Affected versions of this package are vulnerable to Exposure of Sensitive Information Through Metadata via CFB quick-check decryption oracle in the getDataStream method of PGPSymmetricKeyEncryptedData, reached through PGPPBEEncryptedData, PGPSessionKeyEncryptedData, and...