GHSA-3XC7-XG67-PW99 Sensitive Data Exposure in sequelize-cli

Versions of sequelize-cli prior to 5.5.0 are vulnerable to Sensitive Data Exposure. The function filteredURL does not properly sanitize the config.password value which may cause passwords with special characters to be logged in plain text. Recommendation Upgrade to version 5.5.0 or later...

Sensitive Data Exposure in sequelize-cli

Versions of sequelize-cli prior to 5.5.0 are vulnerable to Sensitive Data Exposure. The function filteredURL does not properly sanitize the config.password value which may cause passwords with special characters to be logged in plain text. Recommendation Upgrade to version 5.5.0 or later...

UBUNTU-CVE-2019-12210

In Yubico pam-u2f 1.0.7, when configured with debug and a custom debug log file is set using debugfile, that file descriptor is not closed when a new process is spawned. This leads to the file descriptor being inherited into the child process; the child process can then read from and write to it...

Sensitive Data Exposure in pem

Versions of pem before 1.13.2 expose sensitive data when the readPkcs12 is used. The readPkcs12 function reads the certificate and key data from a pkcs12 file using the encryption password. As part of this process it creates a globally readable file with a filename of 20 random 0-f characters in...

SQL Injection Vulnerability in B2C_UQ Cloud Business System (CNVD-2019-18481)

UQ Cloud Business System B2C version is a compact e-commerce system, the platform is developed by PHP7.0+Mysql. B2CUQ Cloud Business System suffers from a SQL injection vulnerability, which can be exploited by attackers to obtain sensitive database information...

Sensitive Data Exposure

Overview Versions of loopback prior to 3.26.0 3.x and 2.42.0 2.x are vulnerable to Sensitive Data Exposure. Invalid API requests to the login endpoint may return information about the first user in the database. This can be used alongside other attacks for credential theft. Recommendation If you'...

SQL Injection Vulnerability in the Website Management System of Henan Lisuo Internet Information Technology Co.

Henan Lisuo Internet Information Technology Co., Ltd. is an Internet comprehensive service organization. There is a SQL injection vulnerability in the website management system of Henan Lisuo Internet Information Technology Co., Ltd, which can be exploited by attackers to obtain sensitive...

CVE-2019-9105

The WebApp v04.68 in the supervisor on SAET Impianti Speciali TEBE Small 05.01 build 1137 devices allows remote attackers to make several types of API calls without authentication, as demonstrated by retrieving password hashes via an inc/utils/RESTAPI.php?command=CallAPI&customurl=alladminusers...

S-CMS enterprise website builder system sc***.php suffers from SQL injection vulnerability

S-CMS enterprise station building system is Zibo Shining Network Technology Co., Ltd. developed a specialized enterprise station building solutions for the product. S-CMS enterprise website builder system sc.php exists SQL injection vulnerability, attackers can use the vulnerability to obtain...

SQL Injection Vulnerability in Se***.aspx Page of Qixing Conference Booking System

Qixing Meeting Booking System is a meeting booking system that prevents meeting conflicts and allows you to view the utilization rate of each meeting room in order to optimize the configuration of the meeting room. A SQL injection vulnerability exists in the Se.aspx page of the Qixing Meeting...

SQL Injection Vulnerability in Personal Information Modification on Tpshop Us***.php Page

Tpshop is a set of multi-merchant mode developed by Shenzhen Soleil Networks Limited mall system. A SQL injection vulnerability exists in the personal information modification section of the Tpshop Us.php page. An attacker can exploit the vulnerability to obtain sensitive information from the...

SQL injection vulnerability in Tpshop v3.5 Us***.php page (CNVD-2019-17501)

Tpshop is a set of multi-merchant mode developed by Shenzhen Soleil Networks Limited mall system. A SQL injection vulnerability exists in the Tpshop v3.5 Us.php page. Attackers can use the vulnerability to obtain sensitive information in the database...

ORM Injection Vulnerability in sqlalchemy

SQLAlchemy is a Python SQL toolkit and database object mapping framework. An ORM injection vulnerability exists in sqlalchemy, which can be exploited by an attacker to obtain sensitive database information...

SQL injection vulnerability in ab***.php page of Jinan Yuxia Information Technology Co.

Jinan Yuxia Information Technology Co., Ltd. to the Internet products and related services as the main direction, is a collection of website construction and network promotion, IDC business, software development, server hosting, telecommunications value-added services and other integrated service...

CVE-2018-20007

Yeelight Smart AI Speaker 3.3.100074 devices have improper access control over the UART interface, allowing physical attackers to obtain a root shell. The attacker can then exfiltrate the audio data, read cleartext Wi-Fi credentials in a log file, or access other sensitive device and user...

SQL Injection Vulnerability in Acme CMS Backend po***_ed***.php

Acme CMS is a full-featured, PHP + Mysql architecture, multi-language, responsive display, suitable for personal website construction CMS building system. There is a SQL injection vulnerability in the background poed.php of Acme CMS, which can be exploited by attackers to obtain sensitive databas...

PHPOK Enterprise Building System v5.2.116 SQL Injection Vulnerability in Frontend

PHPOK is a set of enterprise station CMS system developed in PHP + MYSQL language. PHPOK Enterprise Station Building System v5.2.116 has a SQL injection vulnerability in the frontend. An attacker can exploit this vulnerability to obtain sensitive database information...

Chaozhou Weipai Network Technology Co., Ltd. website building system has SQL injection vulnerabilities

Weipai Technology is specializing in micro-platform planning and development, leveraging on the WeChat public platform and open platform, customized display, interaction, sharing, promotion and sales in one of the micro-platform. There is a SQL injection vulnerability in the website building syst...

Suzhou Jushang Network Technology Co., Ltd. website building system has SQL injection vulnerabilities

Suzhou Jushang Network Technology Co., Ltd. is a business enterprise e-commerce solutions, website construction, domain name registration, web hosting, enterprise post office, software development, system integration, Baidu search bidding ranking promotion and other services. Suzhou Jushang Netwo...

SQL Injection Vulnerability in Acme cms

Acme CMS is a CMS builder using PHP + Mysql architecture, multi-language, responsive display, suitable for personal website construction. Acme CMS has a SQL injection vulnerability, which can be exploited by attackers to obtain sensitive database information...