CVE-2024-39677 NHibernate SQL injection vulnerability in discriminator mappings, static fields referenced in HQL, and some utilities

NHibernate is an object-relational mapper for the .NET framework. A SQL injection vulnerability exists in some types implementing ILiteralType.ObjectToSQLString. Callers of these methods are exposed to the vulnerability, which includes mappings using inheritance with discriminator values; HQL...

NHibernate SQL injection vulnerability in discriminator mappings, static fields referenced in HQL, and some utilities

Impact A SQL injection vulnerability exists in some types implementing ILiteralType.ObjectToSQLString. Callers of these methods are exposed to the vulnerability, which includes: - Mappings using inheritance with discriminator values: - The discriminator value could be written in the mapping in a...

SQL Injection

egroupware/egroupware is vulnerable to Sql Injection. The vulnerability is due to improper handling of the ORDER BY clause in database queries, potentially leading to SQL injection. An attacker can exploit this vulnerability to manipulate database queries, leading to unauthorized data access or...

PT-2024-28616 · Hibernate · Hibernate

Name of the Vulnerable Software and Affected Versions: NHibernate versions prior to 5.4.9 NHibernate versions prior to 5.5.2 Description: A SQL injection vulnerability exists in some types implementing ILiteralType.ObjectToSQLString. This vulnerability affects callers of these methods, including...

The vulnerability of the XStore plugin of the WordPress content management system allows a hacker to execute arbitrary SQL queries against the database.

The vulnerability of the XStore plugin of the WordPress content management system is related to the lack of security measures for the SQL query structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary SQL queries against the database...

SQL Injection

craftcms/cms is vulnerable to SQL Injection. The vulnerability is caused by insufficient sanitization and validation of user-supplied input within GraphQL queries, allowing attackers to manipulate these queries to execute arbitrary SQL commands...

CVE-2024-6471

A vulnerability classified as critical has been found in SourceCodester Online Tours & Travels Management 1.0. This affects an unknown part of the file smssetting.php. The manipulation of the argument uname leads to sql injection. It is possible to initiate the attack remotely. The exploit has be...

SQL Injection

parse-server is vulnerable to SQL Injection. The vulnerability is due to improper handling of user-supplied input when configured with the PostgreSQL database, allowing malicious SQL queries to be executed...

WordPress plugin Email Subscribers by Icegram Express Security Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation, a blogging platform developed in the PHP language. WordPress plugin is an application plugin that supports personal blog sites on servers running PHP and MySQL. A security vulnerability exists in the WordPress plugin...

SQLite 3.25.2 when queries are run on a table with a malformed PRIMARY KEY allows remote attackers to cause a denial of service (application crash) by leveraging the ability to run arbitrary SQL statements (such as in certain WebSQL use cases).

...

USN-5615-3 sqlite3 vulnerability

USN-5615-1 fixed several vulnerabilities in SQLite. This update provides the corresponding fix for CVE-2020-35525 for Ubuntu 14.04 LTS. Original advisory details: It was discovered that SQLite incorrectly handled INTERSEC query processing. An attacker could use this issue to cause SQLite to crash...

[SECURITY] Fedora 39 Update: python-dns-2.6.1-1.fc39

dnspython is a DNS toolkit for Python. It supports almost all record types. It can be used for queries, zone transfers, and dynamic updates. It supports TSIG authenticated messages and EDNS0. dnspython provides both high and low level access to DNS. The high level classes perform queries for data...

The vulnerability of IBM DB2 database management systems and IBM DB2 Connect Servers lies in resource management errors, which allow attackers to cause service failures.

The vulnerability of IBM DB2 database management systems, including IBM DB2 Connect Server, is related to resource management errors. Exploiting this vulnerability can allow attackers to cause service interruptions by executing specially crafted SQL queries remotely...

The vulnerability of IBM DB2 database management systems and IBM DB2 Connect Servers lies in resource management errors, which allow attackers to cause service failures.

The vulnerability of IBM DB2 database management systems, including IBM DB2 Connect Server, is related to the unlimited distribution of resources. Exploiting this vulnerability can allow a malicious actor to cause service interruptions through specially crafted queries...

The vulnerability of IBM DB2 database management systems and IBM DB2 Connect Servers lies in resource management errors, which allow attackers to cause service failures.

The vulnerability of IBM DB2 database management systems, including IBM DB2 Connect Server, is related to the unlimited distribution of resources. Exploiting this vulnerability can allow a malicious actor to cause service interruptions through specially crafted queries...

SQL Injection

Gin-vue-admin is vulnerable to SQL injection. The vulnerability is due to insufficient validation user input which allows an attacker to execute arbitrary SQL queries...

WordPress plugin WP Hotel Booking security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...

SUSE SLES15: bind / bind-chrootenv / bind-devel / bind-doc / bind-utils / etc (SUSE-SU-2024:2033-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:2033-1 advisory. - CVE-2023-4408: Fixed denial of service during DNS message parsing with different names bsc1219851 - CVE-2023-50387: Fixed denial ...

BIT-ELK-2024-37279 Kibana Broken Access Control issue

A flaw was discovered in Kibana, allowing view-only users of alerting to use the runsoon API making the alerting rule run continuously, potentially affecting the system availability if the alerting rule is running complex queries...

OESA-2024-1724 three-eight-nine-ds-base security update

389-ds-base is an LDAPv3 compliant server which includes the LDAP server and command line utilities for server administration. Security Fixes: A denial of service vulnerability was found in 389-ds-base ldap server. This issue may allow an authenticated user to cause a server crash while modifying...