CVE-2021-41147

Tuleap Open ALM is a libre and open source tool for end to end traceability of application and system developments. Prior to version 11.16.99.173 of Community Edition and versions 11.16-6 and 11.15-8 of Enterprise Edition, an attacker with admin rights in one agile dashboard service can execute...

Nagios XI SQL Injection Vulnerability (CNVD-2021-90908)

Nagios XI is a commercial monitoring solution built on Nagios Core, including dashboards, web-based configuration, advanced reporting, and rich data visualization.A SQL injection vulnerability exists in the bulk modification feature of Nagios XI versions prior to 5.8.5. An attacker could exploit...

PT-2021-23128

Name of the Vulnerable Software and Affected Versions Tuleap Community Edition versions prior to 11.16.99.173 Tuleap Enterprise Edition versions prior to 11.16-6 Tuleap Enterprise Edition version 11.15-8 and earlier Description The issue allows an attacker with the ability to add the CI widget to...

PT-2021-23127

Name of the Vulnerable Software and Affected Versions Tuleap Community Edition versions prior to 11.16.99.173 Tuleap Enterprise Edition versions prior to 11.16-6 and 11.15-8 Description The issue allows an attacker with admin rights in one agile dashboard service to execute arbitrary SQL queries...

CVE-2021-41148: Improper Neutralization of Special Elements used in an SQL Command

Tuleap Open ALM is a libre and open source tool for end to end traceability of application and system developments. Prior to version 11.16.99.173 of Community Edition and versions 11.16-6 and 11.15-8 of Enterprise Edition, an attacker with the ability to add one the CI widget to its personal...

CVE-2021-33177

The Bulk Modifications functionality in Nagios XI versions prior to 5.8.5 is vulnerable to SQL injection. Exploitation requires the malicious actor to be authenticated to the vulnerable system, but once authenticated they would be able to execute arbitrary sql queries...

CVE-2021-33177: Improper Neutralization of Special Elements used in an SQL Command

The Bulk Modifications functionality in Nagios XI versions prior to 5.8.5 is vulnerable to SQL injection. Exploitation requires the malicious actor to be authenticated to the vulnerable system, but once authenticated they would be able to execute arbitrary sql queries...

Police Crime Record Management Project 1.0 - Time Based SQL injection Vulnerability

Exploit Title: Police Crime Record Management Project 1.0 - Time Based SQLi Exploit Author: t//\1 Vendor Homepage: https://www.sourcecodester.com/php/14894/police-crime-record-management-system.html Tested on: Linux Version: 1.0 Exploit Description: The application is prone to an arbitrary...

Police Crime Record Management Project 1.0 - Time Based SQLi

Exploit Title: Police Crime Record Management Project 1.0 - Time Based SQLi Exploit Author: t//\1 Date: 23/09/2021 Vendor Homepage: https://www.sourcecodester.com/php/14894/police-crime-record-management-system.html Tested on: Linux Version: 1.0 Exploit Description: The application is prone to an...

Simple Attendance System 1.0 - Unauthenticated Blind SQL Injection Vulnerability

Exploit Title: Simple Attendance System 1.0 - Unauthenticated Blind SQLi Exploit Author: t//\1 Vendor Homepage: https://www.sourcecodester.com/php/14948/simple-attendance-system-php-and-sqlite-free-source-code.html Tested on: Linux Version: v1.0 Exploit Description: The application suffers from a...

South Gate Inn Online Reservation System 1.0 Shell Upload / SQL Injection

Exploit Title: South Gate Inn Online Reservation System v1.0 - Remote Code Execution Date: 21.09.2021 Exploit Author: Janik Wehrli Vendor Homepage: https://www.sourcecodester.com/php/10584/south-gate-inn-online-reservation-system.html Software Link:...

SolarWinds Network Performance Monitor WriteToFile SQL Injection Privilege Escalation Vulnerability

This vulnerability allows remote attackers to escalate privileges on affected installations of SolarWinds Network Performance Monitor. Authentication is required to exploit this vulnerability. The specific flaw exists within the WriteToFile method. The issue results from the lack of proper...

ROS-2-1246

2.1246 Multiple vulnerabilities in Moodle CVE-2021-32472 - CVE-2021-32478 1. Vulnerability Description: CVE-2021-32478 A vulnerability exists due to insufficient cleansing of user-provided data at the LTI authorization endpoint. A remote attacker could trick a victim into clicking a specially...

ROS-2-1276

2.1276 Multiple vulnerabilities in Moodle CVE-2021-32472 - CVE-2021-32478 1. Vulnerability Description: CVE-2021-32478 A vulnerability exists due to insufficient cleansing of user-provided data at the LTI authorization endpoint. A remote attacker could trick a victim into clicking a specially...

PT-2021-4507

Name of the Vulnerable Software and Affected Versions openSIS version 8.0 Description A SQL Injection issue exists, allowing a malicious attacker to issue SQL commands to the database through the password stn id parameter in ResetUserInfo.php. This can enable a remote attacker to execute arbitrar...

PT-2021-4493

Name of the Vulnerable Software and Affected Versions openSIS version 8.0 Description A SQL Injection issue exists, allowing a malicious attacker to issue SQL commands to the database through the username parameter in the "index.php" endpoint. This can enable a remote attacker to execute arbitrar...

CVE-2021-36690

A segmentation fault can occur in the sqlite3.exe command-line component of SQLite 3.36.0 via the idxGetTableInfo function when there is a crafted SQL query. NOTE: the vendor disputes the relevance of this report because a sqlite3.exe user already has full privileges e.g., is intentionally allowe...

PT-2021-5149

Name of the Vulnerable Software and Affected Versions Advantech R-SeeNet affected versions not specified Description The issue is related to the incorrect handling of the name filter parameter in the device list component of the Advantech R-SeeNet monitoring software. This can allow a remote...

PT-2021-5480

Name of the Vulnerable Software and Affected Versions Advantech R-SeeNet affected versions not specified Description The issue is related to a SQL injection vulnerability. It can be triggered by making authenticated HTTP requests to the company filter parameter, potentially through cross-site...

Rockwellautomation Rslinx Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Products that use EDS Subsystem: Version 28.0.1 and prior FactoryTalk Linx software Previously called RSLinx Enterprise: Versions 6.00, 6.10, and 6.11, RSLinx Classic: Version 4.11.00 and prior, RSNetWorx software: Version 28.00.00 and prior, Studio 5000 Logix Designer software: Version 32 and...