Security Bulletin: Multiple Vulnerabilities affect InfoSphere Data Replication Dashboard (CVE-2013-2999, CVE-2013-3001, CVE-2013-3000)

Abstract The InfoSphere Data Replication Dashboard has been affected by multiple vulnerabilities. See description of CVE-2013-2999, CVE-2013-3001, and CVE-2013-3000 below. Content VULNERABILITY DETAILS: CVE ID: CVE-2013-2999 DESCRIPTION: The Infosphere Data Replication Dashboard for mobile device...

CVE-2022-40446: Improper Neutralization of Special Elements used in an SQL Command

ZZCMS 2022 was discovered to contain a SQL injection vulnerability via the component /admin/sendmailto.php?tomail=&groupid=...

CVE-2022-38771: Improper Neutralization of Special Elements used in an SQL Command

The mobile application in Transtek Mojodat FAM Fixed Asset Management 2.4.6 allows remote attackers to send SCRIPT tags as injected input to the API request...

CVE-2022-38281: Improper Neutralization of Special Elements used in an SQL Command

JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/site/list...

CVE-2022-38278: Improper Neutralization of Special Elements used in an SQL Command

JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/friendlylink/list...

CVE-2022-29058: Improper Neutralization of Special Elements used in an SQL Command

An improper neutralization of special elements CWE-89 used in an OS command vulnerability CWE-78 in the command line interpreter of FortiAP 6.0.0 through 6.4.7, 7.0.0 through 7.0.3, 7.2.0, FortiAP-S 6.0.0 through 6.4.7, FortiAP-W2 6.0.0 through 6.4.7, 7.0.0 through 7.0.3, 7.2.0 and FortiAP-U 5.4....

CVE-2022-36242: Improper Neutralization of Special Elements used in an SQL Command

Clinic's Patient Management System v1.0 is vulnerable to SQL Injection via /pms/updatemedicine.php?id=...

CVE-2022-38130: Improper Neutralization of Special Elements used in an SQL Command

The com.keysight.tentacle.config.ResourceManager.smsRestoreDatabaseZip method is used to restore the HSQLDB database used in SMS. It takes the path of the zipped database file as the single parameter. An unauthenticated, remote attacker can specify an UNC path for the database file i.e., \ \sms\ ...

CVE-2022-31659: Improper Neutralization of Special Elements used in an SQL Command

VMware Workspace ONE Access and Identity Manager contain a remote code execution vulnerability. A malicious actor with administrator and network access can trigger a remote code execution...

CVE-2022-32456: Improper Neutralization of Special Elements used in an SQL Command

Digiwin BPM’s function has insufficient validation for user input. An unauthenticated remote attacker can inject arbitrary SQL command to access, modify, delete database or disrupt service...

CVE-2022-31092: Improper Neutralization of Special Elements used in an SQL Command

Pimcore is an Open Source Data & Experience Management Platform. Pimcore offers developers listing classes to make querying data easier. This listing classes also allow to order or group the results based on one or more columns which should be quoted by default. The actual issue is that quoting i...

CVE-2022-32331: Improper Neutralization of Special Elements used in an SQL Command

Fast Food Ordering System v1.0 is vulnerable to SQL Injection via /ffos/admin/categories/viewcategory.php?id=...

CVE-2022-32339: Improper Neutralization of Special Elements used in an SQL Command

Hospital's Patient Records Management System v1.0 is vulnerable to SQL Injection via /hprms/admin/doctors/viewdoctor.php?id=...

CVE-2022-32337: Improper Neutralization of Special Elements used in an SQL Command

Hospital's Patient Records Management System v1.0 is vulnerable to SQL Injection via /hprms/admin/patients/managepatient.php?id=...

CVE-2022-32363: Improper Neutralization of Special Elements used in an SQL Command

Product Show Room Site v1.0 is vulnerable to SQL Injection via /psrs/admin/categories/viewcategory.php?id=...

CVE-2022-32365: Improper Neutralization of Special Elements used in an SQL Command

Product Show Room Site v1.0 is vulnerable to SQL Injection via /psrs/admin/fields/managefield.php?id=...

CVE-2022-32354: Improper Neutralization of Special Elements used in an SQL Command

Product Show Room Site v1.0 is vulnerable to SQL Injection via /psrs/admin/?page=user/manageuser&id=...

CVE-2022-32011: Improper Neutralization of Special Elements used in an SQL Command

Complete Online Job Search System v1.0 is vulnerable to SQL Injection via /eris/admin/applicants/index.php?view=view&id=...

CVE-2022-32021: Improper Neutralization of Special Elements used in an SQL Command

Car Rental Management System v1.0 is vulnerable to SQL Injection via /car-rental-management-system/admin/managemovement.php?id=...

CVE-2022-31350: Improper Neutralization of Special Elements used in an SQL Command

Online Car Wash Booking System v1.0 is vulnerable to SQL Injection via /ocwbs/admin/vehicles/managevehicle.php?id=...