15497 matches found
CVE-2018-10593
A vulnerability in DB Manager version 3.0.1.0 and previous and PerformA version 3.0.0.0 and previous allows an authorized user with access to a privileged account on a BD Kiestra system Kiestra TLA, Kiestra WCA, and InoqulA+ specimen processor to issue SQL commands, which may result in data...
CVE-2018-10595
A vulnerability in ReadA version 1.1.0.2 and previous allows an authorized user with access to a privileged account on a BD Kiestra system Kiestra TLA, Kiestra WCA, and InoqulA+ specimen processor to issue SQL commands, which may result in loss or corruption of data...
PT-2018-9986
Name of the Vulnerable Software and Affected Versions: ReadA versions 1.1.0.2 and previous Description: A vulnerability allows an authorized user with access to a privileged account on a BD Kiestra system to issue SQL commands, potentially resulting in loss or corruption of data. Recommendations:...
PT-2018-9984
Name of the Vulnerable Software and Affected Versions: DB Manager versions prior to 3.0.1.0 PerformA versions prior to 3.0.0.0 Description: A vulnerability allows an authorized user with access to a privileged account on a BD Kiestra system to issue SQL commands, potentially resulting in data...
CVE-2018-10595: Product UI does not Warn User of Unsafe Actions
A vulnerability in ReadA version 1.1.0.2 and previous allows an authorized user with access to a privileged account on a BD Kiestra system Kiestra TLA, Kiestra WCA, and InoqulA+ specimen processor to issue SQL commands, which may result in loss or corruption of data...
CVE-2018-9019
SQL Injection vulnerability in Dolibarr before version 7.0.2 allows remote attackers to execute arbitrary SQL commands via the sortfield parameter to /accountancy/admin/accountmodel.php, /accountancy/admin/categorieslist.php, /accountancy/admin/journalslist.php, /admin/dict.php,...
CVE-2018-9019
SQL Injection vulnerability in Dolibarr before version 7.0.2 allows remote attackers to execute arbitrary SQL commands via the sortfield parameter to /accountancy/admin/accountmodel.php, /accountancy/admin/categorieslist.php, /accountancy/admin/journalslist.php, /admin/dict.php,...
Sql injection
SQL Injection vulnerability in Dolibarr before version 7.0.2 allows remote attackers to execute arbitrary SQL commands via the sortfield parameter to /accountancy/admin/accountmodel.php, /accountancy/admin/categorieslist.php, /accountancy/admin/journalslist.php, /admin/dict.php,...
PT-2018-3603
Name of the Vulnerable Software and Affected Versions Dolibarr versions prior to 7.0.2 Description The issue allows remote attackers to execute arbitrary SQL commands via the sortfield parameter to "/accountancy/admin/accountmodel.php", "/accountancy/admin/categories list.php",...
BD Kiestra and InoquIA Systems (Update A)
1. EXECUTIVE SUMMARY CVSS v3 6.3 ATTENTION : Exploitable from adjacent network Vendor : Becton, Dickinson and Company BD Equipment : BD Kiestra and InoqulA systems Vulnerabilities : Product UI does not Warn User of Unsafe Actions 2. UPDATE INFORMATION This updated advisory is a follow-up to the...
CVE-2018-9250
interface\super\editlist.php in OpenEMR before v5011 allows remote authenticated users to execute arbitrary SQL commands via the newlistname parameter...
CVE-2018-9250
interface\super\editlist.php in OpenEMR before v5011 allows remote authenticated users to execute arbitrary SQL commands via the newlistname parameter...
PT-2018-18932
Name of the Vulnerable Software and Affected Versions OpenEMR versions prior to 5.0.1.1 Description The issue allows remote authenticated users to execute arbitrary SQL commands. This is achieved via the newlistname parameter in the 'interfacesuperedit list.php' file. Recommendations For versions...
Sql injection
SQL injection vulnerability in UPnP DMA in Synology Media Server before 1.7.6-2842 and before 1.4-2654 allows remote attackers to execute arbitrary SQL commands via the ObjectID parameter...
CVE-2018-8734: Improper Neutralization of Special Elements used in an SQL Command
SQL injection vulnerability in the core config manager in Nagios XI 5.2.x through 5.4.x before 5.4.13 allows an attacker to execute arbitrary SQL commands via the selInfoKey1 parameter...
PT-2018-8889
Name of the Vulnerable Software and Affected Versions Cybozu Garoon versions 3.5.0 through 4.2.6 Description The issue allows remote authenticated attackers to execute arbitrary SQL commands. Recommendations For versions 3.5.0 through 4.2.6, update to a version that contains a fix for this issue...
A Deep Dive into Database Attacks [Part IV]: Delivery and Execution of Malicious Executables through SQL Commands (MySQL)
In a previous post we covered different techniques for execution of SQL and OS commands through Microsoft SQL server that can be used for delivering and executing malicious payloads on the target system. In this post we’ll discuss the same topic for MySQL database. Creating an executable directly...
CVE-2018-8820
An issue was discovered in Square 9 GlobalForms 6.2.x. A Time Based SQL injection vulnerability in the "match" parameter allows remote authenticated attackers to execute arbitrary SQL commands. It is possible to upgrade access to full server compromise via xpcmdshell. In some cases, the...
Sql injection
DISPUTED SQL injection vulnerability in SQLiteDatabase.java in the SQLi Api in Android allows remote attackers to execute arbitrary SQL commands via the delete method...
CVE-2014-4959
Technical details about CVE-2014-4959 are not publicly provided in the included documents; no affected products, root cause, impact, or remediation are specified. Monitor for updates.