5466 matches found
CVE-2021-22851: Improper Neutralization of Special Elements used in an SQL Command
HGiga EIP product contains SQL Injection vulnerability. Attackers can inject SQL commands into specific URL parameter document management page to obtain database schema and data...
CVE-2021-22852: Improper Neutralization of Special Elements used in an SQL Command
HGiga EIP product contains SQL Injection vulnerability. Attackers can inject SQL commands into specific URL parameter online registration to obtain database schema and data...
PT-2021-15225
Name of the Vulnerable Software and Affected Versions HGiga EIP product affected versions not specified Description The issue allows attackers to inject SQL commands into a specific URL parameter, namely the online registration parameter, to obtain the database schema and data. Recommendations At...
Oracle MySQL Access Control Vulnerability
Oracle MySQL is an open source relational database management system.MySQL Server mysqld is the MySQL server, the main program that performs most of the work in a MySQL installation. An unspecified vulnerability exists in the Information Schema component in Oracle MySQL Server 5.7.32, 8.0.22, and...
PT-2021-15224
Name of the Vulnerable Software and Affected Versions HGiga EIP product affected versions not specified Description The issue allows attackers to inject SQL commands into a specific URL parameter on the document management page to obtain database schema and data. Recommendations At the moment,...
postgresql: Multiple features escape "security restricted operation" sandbox
A flaw was found in postgresql. An attacker having permission to create non-temporary objects in at least one schema can execute arbitrary SQL functions under the identity of a superuser. The highest threat from this vulnerability is to data confidentiality and integrity as well as system...
postgresql: TYPE in pg_temp executes arbitrary SQL during SECURITY DEFINER execution
A flaw was discovered in postgresql where arbitrary SQL statements can be executed given a suitable SECURITY DEFINER function. An attacker, with EXECUTE permission on the function, can execute arbitrary SQL as the owner of the function...
postgresql: Multiple features escape "security restricted operation" sandbox
A flaw was found in postgresql. An attacker having permission to create non-temporary objects in at least one schema can execute arbitrary SQL functions under the identity of a superuser. The highest threat from this vulnerability is to data confidentiality and integrity as well as system...
postgresql: Multiple features escape "security restricted operation" sandbox
A flaw was found in postgresql. An attacker having permission to create non-temporary objects in at least one schema can execute arbitrary SQL functions under the identity of a superuser. The highest threat from this vulnerability is to data confidentiality and integrity as well as system...
postgresql: Multiple features escape "security restricted operation" sandbox
A flaw was found in postgresql. An attacker having permission to create non-temporary objects in at least one schema can execute arbitrary SQL functions under the identity of a superuser. The highest threat from this vulnerability is to data confidentiality and integrity as well as system...
postgresql: Multiple features escape "security restricted operation" sandbox
A flaw was found in postgresql. An attacker having permission to create non-temporary objects in at least one schema can execute arbitrary SQL functions under the identity of a superuser. The highest threat from this vulnerability is to data confidentiality and integrity as well as system...
Security Bulletin: A vulnerability exists in the Event Streams 10.0.0 schema registry that allows unauthorised access to create, edit and delete schemas (CVE-2020-4662)
Summary A vulnerability exists in the Event Streams 10.0.0 schema registry that allows unauthorised access to create, edit and delete schemas Vulnerability Details CVEID: CVE-2020-4662 DESCRIPTION: IBM Event Streams could allow an authenticated user to perform tasks to a schema due to improper...
Security Bulletin: IBM Event Streams is affected by multiple Node.js vulnerabilities
Summary IBM Event Streams is affected by the following vulnerabilities in the included Node.js runtime that is used for the UI and Schema Registry Vulnerability Details CVEID: CVE-2020-8277 DESCRIPTION: Node.js is vulnerable to a denial of service. By getting the application to resolve a DNS reco...
[SECURITY] Fedora 32 Update: python-lxml-4.4.1-5.fc32
lxml is a Pythonic, mature binding for the libxml2 and libxslt libraries. It provides safe and convenient access to these libraries using the ElementTre e It extends the ElementTree API significantly to offer support for XPath, Relax NG, XML Schema, XSLT, C14N and much more.To contact the project...
[SECURITY] Fedora 33 Update: python-lxml-4.5.1-3.fc33
lxml is a Pythonic, mature binding for the libxml2 and libxslt libraries. It provides safe and convenient access to these libraries using the ElementTre e It extends the ElementTree API significantly to offer support for XPath, Relax NG, XML Schema, XSLT, C14N and much more.To contact the project...
PT-2021-27630
Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: The issue is related to a crash caused by a use-of-uninitialized-value error. The crash occurs in the following functions: read pbkdf2 params, gnutls rea...
Arbitrary Code Execution
djv is vulnerable to Arbitrary Code Execution. An attacker is able to execute arbitrary Javascript code on the host OS by controlling the schema file...
CVE-2020-28464
This affects the package djv before 2.1.4. By controlling the schema file, an attacker can run arbitrary JavaScript code on the victim machine...
