CVE-2020-5292 Time-based blind injection in Leantime

Leantime before versions 2.0.15 and 2.1-beta3 has a SQL Injection vulnerability. The impact is high. Malicious users/attackers can execute arbitrary SQL queries negatively affecting the confidentiality, integrity, and availability of the site. Attackers can exfiltrate data like the users' and...

GHSA-8F93-RV4P-X4JW SQL Injection in sql

All versions of sql are vulnerable to sql injection as it does not properly escape parameters when building SQL queries. Recommendation No fix is currently available for this vulnerability. It is our recommendation to not install or use this module until a fix is available...

CVE-2019-3797

This affects Spring Data JPA in versions up to and including 2.1.5, 2.0.13 and 1.11.19. Derived queries using any of the predicates ‘startingWith’, ‘endingWith’ or ‘containing’ could return more results than anticipated when a maliciously crafted query parameter value is supplied. Also, LIKE...