PYSEC-2024-12

LlamaIndex aka llamaindex through 0.9.34 allows SQL injection via the Text-to-SQL feature in NLSQLTableQueryEngine, SQLTableRetrieverQueryEngine, NLSQLRetriever, RetrieverQueryEngine, and PGVectorSQLQueryEngine. For example, an attacker might be able to delete this year's student records via "Dro...

PT-2024-20057

Name of the Vulnerable Software and Affected Versions LlamaIndex aka llama index versions 0.9.34 and earlier Description The issue allows SQL injection via the Text-to-SQL feature in NLSQLTableQueryEngine, SQLTableRetrieverQueryEngine, NLSQLRetriever, RetrieverQueryEngine, and...

WordPress RSS Feed Retriever Plugin <= 1.6.7 is vulnerable to Cross Site Request Forgery (CSRF)

Software RSS Feed Retriever Type Plugin Vulnerable versions = 1.6.7 Fixed in 1.6.8 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE N/A Patch priority Low CVSS severity Low 3.1 Developer Claim ownership PSID de28d2cfcddb Credits N/A Required privilege...

WordPress RSS Feed Retriever Plugin <= 1.6.7 is vulnerable to Broken Access Control

Software RSS Feed Retriever Type Plugin Vulnerable versions = 1.6.7 Fixed in 1.6.8 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE N/A Patch priority Medium CVSS severity Medium 5.4 Developer Claim ownership PSID 7b026c8a46c6 Credits N/A Required privilege...

Malicious code in wpt-retriever (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware dcde936792fe2faa2b9af81f4b0880a90f4aa6c5aa3d8a9f0c067582a8fa1965 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-7236 Malicious code in wpt-retriever (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware dcde936792fe2faa2b9af81f4b0880a90f4aa6c5aa3d8a9f0c067582a8fa1965 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PT-2022-19387 · Jenkins · Jenkins Pipeline: Shared Groovy Libraries Plugin +2

Name of the Vulnerable Software and Affected Versions: Jenkins Pipeline: Shared Groovy Libraries Plugin versions 564.ve62a 4eb b e039 and earlier, except version 2.21.3 Description: The issue allows attackers who can submit pull requests, but not commit directly to the configured SCM, to change t...

Lenovo Thin Installer 输入验证错误漏洞

Lenovo Thin Installer is an installer from CHN Lenovo Lenovo. for use with Update Retriever to pull driver, software, and system updates from a customized update repository in the cloud or on the network. Lenovo Thin Installer suffers from an input validation error vulnerability that stems from a...

LMA ISIDA Retriever Cross-Site Scripting Vulnerability

LMA-ISIDA Retriever is an application of the Russian company LMA-ISIDA. It provides management and information support on enterprise, regional scale. A cross-site scripting vulnerability exists in LMA ISIDA Retriever version 5.2, which stems from the lack of proper validation of client data for...

CVE-2021-26903

LMA ISIDA Retriever 5.2 is vulnerable to XSS via query'text'...

CVE-2021-26903

LMA ISIDA Retriever 5.2 is vulnerable to XSS via query'text'...

CVE-2021-26904

LMA ISIDA Retriever 5.2 allows SQL Injection...

CVE-2021-26904

LMA ISIDA Retriever 5.2 allows SQL Injection...

CVE-2021-26904

LMA ISIDA Retriever 5.2 allows SQL Injection...

Sql injection

LMA ISIDA Retriever 5.2 allows SQL Injection...

CVE-2021-26903

LMA ISIDA Retriever 5.2 is vulnerable to XSS via query'text'...

CVE-2021-26903

The CVE-2021-26903 entry concerns LMA ISIDA Retriever 5.2, where a cross-site scripting (XSS) flaw exists in the handling of querytext parameters due to inadequate validation. The CNVD entry explicitly states the vulnerability stems from lack of proper validation of client data for querytext para...

CVE-2021-26904

LMA ISIDA Retriever 5.2 allows SQL Injection...

CVE-2021-26904

CVE-2021-26904 affects LMA ISIDA Retriever 5.2 and is described as a SQL Injection vulnerability. The connected documents corroborate this vulnerability entry. According to NVD, the CVSS metrics show a high to critical impact: CVSS v3.1 base score 9.8 (CRITICAL) with vector CVSS:3.1/AV:N/AC:L/PR:...

LMA ISIDA Retriever 跨站脚本漏洞

LMA-ISIDA Retriever is an application of the Russian company LMA-ISIDA. It provides management and information support on enterprise, regional scale. A cross-site scripting vulnerability exists in LMA ISIDA Retriever version 5.2, which stems from the lack of proper validation of client data for...