CVE-2024-12745

A SQL injection in the Amazon Redshift Python Connector v2.1.4 allows a user to gain escalated privileges via the getschemas, gettables, or getcolumns Metadata APIs. Users are recommended to upgrade to the driver version 2.1.5 or revert to driver version 2.1.3...

CVE-2024-12746

A SQL injection in the Amazon Redshift ODBC Driver v2.1.5.0 Windows or Linux allows a user to gain escalated privileges via the SQLTables or SQLColumns Metadata APIs. Users are recommended to upgrade to the driver version 2.1.6.0 or revert to driver version 2.1.4.0...

CVE-2024-12746

Summary: CVE-2024-12746 concerns the Amazon Redshift ODBC Driver (v2.1.5.0) for Windows/Linux, where a SQL injection via the SQLTables or SQLColumns Metadata APIs can let a user escalate privileges. The issue is confirmed in multiple sources attached to the CVE, with recommended mitigation: upgra...

PT-2024-17487 · WordPress · Print Invoice & Delivery Notes For Woocommerce

Name of the Vulnerable Software and Affected Versions: Print Invoice & Delivery Notes for WooCommerce plugin for WordPress versions up to, and including, 5.4.0 Description: The issue is due to a missing capability check on the wcdn remove shoplogo AJAX action. This makes it possible for...

CVE-2018-25106

A vulnerability, which was classified as critical, has been found in webuidesigning NebulaX Theme up to 5.0 on WordPress. This issue affects the function nebulasendtohubspot of the file libs/Legacy/Legacy.php. The manipulation leads to sql injection. The attack may be initiated remotely. The patc...

GHSA-9PP6-WQ8C-3W2C Gogs allows argument injection during the previewing of changes

Impact Unprivileged user accounts can write to arbitrary files on the filesystem. We could demonstrate its exploitation to force a re-installation of the instance, granting administrator rights. It allows accessing and altering any user's code hosted on the same instance. Patches Unintended Git...

CVE-2024-45387 Apache Traffic Control: SQL Injection in Traffic Ops endpoint PUT deliveryservice_request_comments

An SQL injection vulnerability in Traffic Ops in Apache Traffic Control = 8.0.0 allows a privileged user with role "admin", "federation", "operations", "portal", or "steering" to execute arbitrary SQL against the database by sending a specially-crafted PUT request. Users are recommended to upgrad...

CVE-2024-45387

Summary: CVE-2024-45387 is an SQL injection in Traffic Ops of Apache Traffic Control, affecting versions = 8.0.0. A privileged user with roles such as admin, federation, operations, portal, or steering can run arbitrary SQL against the database via a specially crafted PUT request. The vulnerabili...

D-Link DAP-1520 DoS Vulnerability (SAP10395)

D-Link DAP-1520 devices are prone to a denial of service DoS vulnerability. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

PT-2024-36676 · Vibebp · Vibebp

Name of the Vulnerable Software and Affected Versions: VibeBP versions prior to 1.9.9.5.1 Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injection attacks. The estimated number of...

CVE-2024-12895

A vulnerability has been found in TreasureHuntGame TreasureHunt up to 963e0e0 and classified as critical. Affected by this vulnerability is the function consolelog of the file TreasureHunt/checkflag.php. The manipulation of the argument problema leads to sql injection. The attack can be launched...

CVE-2024-12895 TreasureHuntGame TreasureHunt checkflag.php console_log sql injection

A vulnerability has been found in TreasureHuntGame TreasureHunt up to 963e0e0 and classified as critical. Affected by this vulnerability is the function consolelog of the file TreasureHunt/checkflag.php. The manipulation of the argument problema leads to sql injection. The attack can be launched...

CVE-2024-12895 TreasureHuntGame TreasureHunt checkflag.php console_log sql injection

A vulnerability has been found in TreasureHuntGame TreasureHunt up to 963e0e0 and classified as critical. Affected by this vulnerability is the function consolelog of the file TreasureHunt/checkflag.php. The manipulation of the argument problema leads to sql injection. The attack can be launched...

CVE-2024-12894

A vulnerability, which was classified as critical, was found in TreasureHuntGame TreasureHunt up to 963e0e0. Affected is an unknown function of the file TreasureHunt/acesso.php. The manipulation of the argument usuario leads to sql injection. It is possible to launch the attack remotely. This...

PT-2024-17782 · Unknown · Treasurehuntgame Treasurehunt

Name of the Vulnerable Software and Affected Versions: TreasureHuntGame TreasureHunt up to 963e0e0 Description: A critical vulnerability has been found in TreasureHuntGame TreasureHunt. The issue affects the console log function of the file TreasureHunt/checkflag.php. The manipulation of the...

Debian dla-3997 : php-illuminate-auth - security update

The remote Debian 11 host has packages installed that are affected by a vulnerability as referenced in the dla-3997 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-3997-1 [email protected] https://www.debian.org/lts/security/...

CVE-2024-56335 Privilege escalation allows organization groups to be updated/deleted if their UUID is known in vaultwarden

vaultwarden is an unofficial Bitwarden compatible server written in Rust, formerly known as bitwardenrs. In affected versions an attacker is capable of updating or deleting groups from an organization given a few conditions: 1. The attacker has a user account in the server. 2. The attacker's...

CVE-2024-56329 Account Takeover Vulnerability in Social Account Linking in joelbutcher/socialstream

Socialstream is a third-party package for Laravel Jetstream. It replaces the published authentication and profile scaffolding provided by Laravel Jetstream, with scaffolding that has support for Laravel Socialite. When linking a social account to an already authenticated user, the lack of a...

CVE-2024-56329

CVE-2024-56329 affects the Socialstream package for Laravel Jetstream (joelbutcher/socialstream). The vulnerability arises during social account linking to an already authenticated user, where a missing confirmation step allows an account takeover risk. The issue is worsened when the Socialite co...

BIT-ENVOY-2024-53270 HTTP/1: sending overload crashes when the request is reset beforehand in envoy

Envoy is a cloud-native high-performance edge/middle/service proxy. In affected versions sendOverloadError is going to assume the active request exists when envoy.loadshedpoints.http1serverabortdispatch is configured. If activerequest is nullptr, only onMessageBeginImpl is called. However, the...