EUVD-2014-1050

Malware in sbrugna...

Cross-site Scripting (XSS)

pomm/pomm is susceptible to cross-site scripting XSS attacks. The attacks are possible because it does not escape the string in LTree converter fromPg function in Pomm/Converter/PgLTree.php...

SQL Injection

Pomm is vulnerable to SQL injections. The library does not escape user supplied strings in the LTree converter, allowing a malicious user to inject and execute arbitrary SQL queries...

CVE-2014-100019

SQL injection vulnerability in the LTree converter in Pomm before 1.1.5 allows remote attackers to execute arbitrary SQL commands via unspecified vectors...

Sql injection

SQL injection vulnerability in the LTree converter in Pomm before 1.1.5 allows remote attackers to execute arbitrary SQL commands via unspecified vectors...

CVE-2014-100019

The vulnerability is in the Pomm library’s LTree converter, where SQL injection is possible in versions before 1.1.5. An attacker could remotely execute arbitrary SQL commands due to lack of escaping for user-supplied strings. Impact and affected components are described in multiple sources (e.g....

CVE-2014-100019

SQL injection vulnerability in the LTree converter in Pomm before 1.1.5 allows remote attackers to execute arbitrary SQL commands via unspecified vectors...

CVE-2014-100019

SQL injection vulnerability in the LTree converter in Pomm before 1.1.5 allows remote attackers to execute arbitrary SQL commands via unspecified vectors...

PT-2015-3625

Name of the Vulnerable Software and Affected Versions Pomm versions prior to 1.1.5 Description The issue allows remote attackers to execute arbitrary SQL commands. Recommendations For versions prior to 1.1.5, update to version 1.1.5 or later to resolve the issue...

CVE-2014-100019: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in the LTree converter in Pomm before 1.1.5 allows remote attackers to execute arbitrary SQL commands via unspecified vectors...