CVE-2020-6230

SAP OrientDB, version 3.0, allows an authenticated attacker with script execute/write permissions to inject code that can be executed by the application and lead to Code Injection. An attacker could thereby control the behavior of the application...

CVE-2020-6230

SAP OrientDB, version 3.0, allows an authenticated attacker with script execute/write permissions to inject code that can be executed by the application and lead to Code Injection. An attacker could thereby control the behavior of the application...

Code injection

SAP OrientDB, version 3.0, allows an authenticated attacker with script execute/write permissions to inject code that can be executed by the application and lead to Code Injection. An attacker could thereby control the behavior of the application...

CVE-2020-6230

CVE-2020-6230 affects SAP OrientDB 3.0. An authenticated attacker with script execute/write permissions can inject code that is executed by the application, leading to Code Injection and potential control of application behavior. The provided documents do not include explicit remediation details....

CVE-2020-6230

SAP OrientDB, version 3.0, allows an authenticated attacker with script execute/write permissions to inject code that can be executed by the application and lead to Code Injection. An attacker could thereby control the behavior of the application...

OrientDB 3.0.17 GA Community Edition - Cross-Site Request Forgery / Cross-Site Scripting

Exploit for multiple platform in category web applications Exploit Title: OrientDB 3.0.17 GA Community Edition March 7th, 2019 | Multiple Vulnerabilities Date: 07.03.2019 Exploit Author: Ozer Goker Vendor Homepage: https://orientdb.org Software Link: https://orientdb.org/download Version: 3.0.17 ...

OrientDB 3.0.17 GA Community Edition - Cross-Site Request Forgery Cross-Site Scripting

OrientDB 3.0.17 GA Community Edition - Cross-Site Request Forgery Cross-Site Scripting Exploit Title: OrientDB 3.0.17 GA Community Edition March 7th, 2019 | Multiple Vulnerabilities Date: 07.03.2019 Exploit Author: Ozer Goker Vendor Homepage: https://orientdb.org Software Link:...

OrientDB 3.0.17 GA Community Edition - Cross-Site Request Forgery / Cross-Site Scripting

Exploit Title: OrientDB 3.0.17 GA Community Edition March 7th, 2019 | Multiple Vulnerabilities Date: 07.03.2019 Exploit Author: Ozer Goker Vendor Homepage: https://orientdb.org Software Link: https://orientdb.org/download Version: 3.0.17 GA Community Edition March 7th, 2019 Introduction OrientDB ...

OrientDB 3.0.17 GA Community Edition XSS / CSRF

Exploit Title: OrientDB 3.0.17 GA Community Edition March 7th, 2019 | Multiple Vulnerabilities Date: 07.03.2019 Exploit Author: Ozer Goker Vendor Homepage: https://orientdb.org Software Link: https://orientdb.org/download Version: 3.0.17 GA Community Edition March 7th, 2019 Introduction OrientDB ...

GHSA-G4GG-9F62-JFPH OrientDB Studio web management interface is vulnerable to clickjacking attacks

The Studio component in OrientDB Server Community Edition before 2.0.15 and 2.1.x before 2.1.1 does not properly restrict use of FRAME elements, which makes it easier for remote attackers to conduct clickjacking attacks via a crafted web site...

OrientDB Studio web management interface is vulnerable to clickjacking attacks

The Studio component in OrientDB Server Community Edition before 2.0.15 and 2.1.x before 2.1.1 does not properly restrict use of FRAME elements, which makes it easier for remote attackers to conduct clickjacking attacks via a crafted web site...

com.orientechnologies:orientdb-community (=2.1.0), com.orientechnologies:orientdb-distributed (=2.1.0) +4 more potentially affected by CVE-2015-2913 via com.orientechnologies:orientdb-server (=2.1.0)

com.orientechnologies:orientdb-server MAVEN version =2.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.orientechnologies:orientdb-server and may be impacted: - com.orientechnologies:orientdb-community =2.1.0 -...

OrientDB Server Community Edition uses insufficiently random values to generate session IDs

OrientDB Server Community Edition before 2.0.15 and 2.1.x before 2.1.1 improperly relies on the java.util.Random class for generation of random Session ID values in the server/network/protocol/http/OHttpSessionManager.java, which makes it easier for remote attackers to predict a value by...

com.orientechnologies:orientdb (>=1.0 <=1.5.1), com.orientechnologies:orientdb-community (>=1.6.5 <=2.0.14) +17 more potentially affected by CVE-2015-2913 via com.orientechnologies:orientdb-server (>=1.0 <=2.0.14)

com.orientechnologies:orientdb-server MAVEN version =1.0, =1.0, =1.6.5, =1.1.0, =2.0, =1.1.0, =2.0, =1.7, =1.0, =0.1.17, =0.2.14 - org.ops4j.orient.samples:orient-sample1 =0.3.0 - org.ops4j.orient.samples:orient-sample2 =0.3.0 - org.ops4j.orient:orient-ra =0.3.0 - org.ops4j.orient:orient-ra-api...

GHSA-V6WR-FCH2-VM5W OrientDB Server Community Edition uses insufficiently random values to generate session IDs

OrientDB Server Community Edition before 2.0.15 and 2.1.x before 2.1.1 improperly relies on the java.util.Random class for generation of random Session ID values in the server/network/protocol/http/OHttpSessionManager.java, which makes it easier for remote attackers to predict a value by...

GHSA-P8WW-VV84-C2RM OrientDB-Server vulnerable to Cross-Site Request Forgery

The JSONP endpoint in the Studio component in OrientDB Server Community Edition before 2.0.15 and 2.1.x before 2.1.1 does not properly restrict callback values, which allows remote attackers to conduct cross-site request forgery CSRF attacks, and obtain sensitive information, via a crafted HTTP...

OrientDB-Server vulnerable to Cross-Site Request Forgery

The JSONP endpoint in the Studio component in OrientDB Server Community Edition before 2.0.15 and 2.1.x before 2.1.1 does not properly restrict callback values, which allows remote attackers to conduct cross-site request forgery CSRF attacks, and obtain sensitive information, via a crafted HTTP...

OrientDB vulnerable to Improper Privilage Management leading to arbitrary command injection

OrientDB through 2.2.22 does not enforce privilege requirements during "where" or "fetchplan" or "order by" use, which allows remote attackers to execute arbitrary OS commands via a crafted request...

ai.grakn:grakn-orientdb-factory (=0.10.0), ai.grakn:orientdb-factory (>=0.11.0 <=0.16.0) +120 more potentially affected by CVE-2017-11467 via com.orientechnologies:orientdb-core (>=1.0 <=2.2.22)

com.orientechnologies:orientdb-core MAVEN version =1.0, =0.11.0, =0.0.7, =0.0.5, =0.8, =0.4, =3.0.0.M1, =0.13, =0.13, =1.0, =1.0, =1.6.5, =2.2.22 and more Source cves: CVE-2017-11467 Source advisory: OSV:GHSA-XM6R-4466-MR74...

GHSA-XM6R-4466-MR74 OrientDB vulnerable to Improper Privilage Management leading to arbitrary command injection

OrientDB through 2.2.22 does not enforce privilege requirements during "where" or "fetchplan" or "order by" use, which allows remote attackers to execute arbitrary OS commands via a crafted request...