[SECURITY] Fedora 32 Update: salt-3001.3-1.fc32

Salt is a distributed remote execution system used to execute commands and query data. It was developed in order to bring the best solutions found in the world of remote execution together and make them better, faster and more malleable. Salt accomplishes this via its ability to handle larger loa...

CVE-2020-12147

In Silver Peak Unity Orchestrator versions prior to 8.9.11+, 8.10.11+, or 9.0.1+, an authenticated user can make unauthorized MySQL queries against the Orchestrator database using the /sqlExecution REST API, which had been used for internal testing...

CVE-2020-12147

In Silver Peak Unity Orchestrator versions prior to 8.9.11+, 8.10.11+, or 9.0.1+, an authenticated user can make unauthorized MySQL queries against the Orchestrator database using the /sqlExecution REST API, which had been used for internal testing...

Code injection

In Silver Peak Unity Orchestrator versions prior to 8.9.11+, 8.10.11+, or 9.0.1+, an authenticated user can make unauthorized MySQL queries against the Orchestrator database using the /sqlExecution REST API, which had been used for internal testing...

CVE-2020-12147

CVE-2020-12147 affects Silver Peak Unity Orchestrator. An authenticated user can issue unauthorized MySQL queries against the Orchestrator database through the /sqlExecution REST API. Affected versions: prior to 8.9.11+, 8.10.11+, or 9.0.1+. Documentation notes that patches are available to remed...

CVE-2020-12147 Unauthorized queries against the Silver Peak Unity OrchestratorTM MySQL database.

In Silver Peak Unity Orchestrator versions prior to 8.9.11+, 8.10.11+, or 9.0.1+, an authenticated user can make unauthorized MySQL queries against the Orchestrator database using the /sqlExecution REST API, which had been used for internal testing...

CVE-2020-7020

Elasticsearch versions before 6.8.13 and 7.9.2 contain a document disclosure flaw when Document or Field Level Security is used. Search queries do not properly preserve security permissions when executing certain complex queries. This could result in the search disclosing the existence of documen...

Elasticsearch Information Disclosure Vulnerability (CNVD-2020-60336)

Elasticsearch is the Netherlands Elasticsearch company's set of open source distributed RESTful search engine built on Lucene . The product is mainly used in cloud computing , and supports data indexing via HTTP using JSON. security is one of the data protection components. An information...

Design/Logic Flaw

Elasticsearch versions before 6.8.13 and 7.9.2 contain a document disclosure flaw when Document or Field Level Security is used. Search queries do not properly preserve security permissions when executing certain complex queries. This could result in the search disclosing the existence of documen...

UBUNTU-CVE-2020-7020

Elasticsearch versions before 6.8.13 and 7.9.2 contain a document disclosure flaw when Document or Field Level Security is used. Search queries do not properly preserve security permissions when executing certain complex queries. This could result in the search disclosing the existence of documen...

CVE-2020-7020

Elasticsearch versions before 6.8.13 and 7.9.2 contain a document disclosure flaw when Document or Field Level Security is used. Search queries do not properly preserve security permissions when executing certain complex queries. This could result in the search disclosing the existence of documen...

Oracle E-Business Suite ozfVendorLov SQL Injection Information Disclosure Vulnerability

This vulnerability allows remote attackers to escalate privileges on affected installations of Oracle E-Business Suite. Authentication is not required to exploit this vulnerability. The specific flaw exists within ozfVendorLov.jsp. The issue results from the lack of proper validation of a...

The vulnerability of the GLPI system’s request, incident, and computer equipment inventory processes, related to the improper elimination of special elements used in SQL commands, allows a malicious actor to execute arbitrary SQL queries against the database in the target system.

The vulnerability of the GLPI system’s request, incident, and computer equipment inventory management functions is related to the improper elimination of certain elements used in SQL commands. Exploiting this vulnerability allows a malicious actor to execute arbitrary SQL queries against the targ...

PT-2020-19345 · Elastic · Elasticsearch

Name of the Vulnerable Software and Affected Versions: Elasticsearch versions prior to 6.8.13 Elasticsearch versions prior to 7.9.2 Description: The issue is related to a document disclosure flaw when Document or Field Level Security is used in Elasticsearch. Search queries do not properly preser...

The vulnerability of the GLPI system’s request, incident, and computer equipment inventory processes, related to the improper elimination of special elements used in SQL commands, allows a malicious actor to execute arbitrary SQL queries against the database in the target system.

The vulnerability of the GLPI system’s request, incident, and computer equipment inventory management functions is related to the improper elimination of certain elements used in SQL commands. Exploiting this vulnerability allows a malicious actor to execute arbitrary SQL queries against the targ...

Security update for bind (moderate)

openSUSE Security Update: Security update for bind Announcement ID: openSUSE-SU-2020:1701-1 Rating: moderate References: 1100369 1109160 1118367 1118368 1128220 1156205 1157051 1161168 1170667 1170713 1171313 1171740 1172958 1173307 1173311 1173983 1175443 1176092 1176674 906079 Cross-References:...

OPENSUSE-SU-2020:1699-1 Security update for bind

This update for bind fixes the following issues: BIND was upgraded to version 9.16.6: Note: - bind is now more strict in regards to DNSSEC. If queries are not working, check for DNSSEC issues. For instance, if bind is used in a namserver forwarder chain, the forwarding DNS servers must support...

suricata-rules

This repository contains Suricata IDS Intrusion Detection System rules for detecting various types of malicious activity, including CobaltStrike, CryptoMiner, and other threats. The rules are designed to identify specific patterns and behaviors associated with these threats. The rules are organiz...

hibernate: SQL injection issue in Hibernate ORM

A flaw was found in Hibernate ORM. A SQL injection in the implementation of the JPA Criteria API can permit unsanitized literals when a literal is used in the SELECT or GROUP BY parts of the query. This flaw could allow an attacker to access unauthorized information or possibly conduct further...

phpMyAdmin SQL Injection Vulnerability (CNVD-2021-45286)

phpMyAdmin is a PHP written, Web-based MySQL and MariaDB open source management tools. A SQL injection vulnerability exists in SearchController in phpMyAdmin. An attacker can exploit this vulnerability to inject malicious SQL into queries...