Design/Logic Flaw

An issue was discovered in DEVOME GRR before 3.4.1c. frmcontactlist.php mishandles a SQL query...

Sql injection

In Administrate rubygem before version 0.13.0, when sorting by attributes on a dashboard, the direction parameter was not validated before being interpolated into the SQL query. This could present a SQL injection if the attacker were able to modify the direction parameter and bypass ActiveRecord...

Sort order SQL injection in Administrate

In Administrate rubygem before version 0.13.0, when sorting by attributes on a dashboard, the direction parameter was not validated before being interpolated into the SQL query. This could present a SQL injection if the attacker were able to modify the direction parameter and bypass ActiveRecord...

GHSA-2P5P-M353-833W Sort order SQL injection in Administrate

In Administrate rubygem before version 0.13.0, when sorting by attributes on a dashboard, the direction parameter was not validated before being interpolated into the SQL query. This could present a SQL injection if the attacker were able to modify the direction parameter and bypass ActiveRecord...

CVE-2020-5257 Sort order SQL injection in Administrate

In Administrate rubygem before version 0.13.0, when sorting by attributes on a dashboard, the direction parameter was not validated before being interpolated into the SQL query. This could present a SQL injection if the attacker were able to modify the direction parameter and bypass ActiveRecord...

CVE-2020-10563

An issue was discovered in DEVOME GRR before 3.4.1c. frmcontactlist.php mishandles a SQL query...

CVE-2020-10563

An issue was discovered in DEVOME GRR before 3.4.1c. frmcontactlist.php mishandles a SQL query...

SQL Injection

In Administrate rubygem, when sorting by attributes on a dashboard, the direction parameter was not validated before being interpolated into the SQL query. This could present a SQL injection if the attacker were able to modify the direction parameter and bypass ActiveRecord SQL protections. Whils...

PT-2020-12205

Name of the Vulnerable Software and Affected Versions DEVOME GRR versions prior to 3.4.1c Description An issue was discovered in the handling of a SQL query by the frmcontactlist.php file. This issue can be exploited due to the mishandling of the SQL query. Recommendations For versions prior to...

Gila CMS SQL Injection Vulnerability

Gila CMS is an open source content management system CMS based on PHP and MySQL. A SQL injection vulnerability exists in /admin/sql?query= in Gila CMS version 1.11.8. The vulnerability stems from a lack of validation of externally entered SQL statements in database-based applications. An attacker...

CVE-2020-5515: Improper Neutralization of Special Elements used in an SQL Command

Gila CMS 1.11.8 allows /admin/sql?query= SQL Injection...

Cisco DNA Center SQL Injection Code Execution

The vulnerability of the Cisco Digital Network Architecture DNA Center’s network management web interface is related to the lack of protective measures for the SQL query structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

CVE-2019-8600

A memory corruption issue was addressed with improved input validation. This issue is fixed in iOS 12.3, macOS Mojave 10.14.5, tvOS 12.3, watchOS 5.2.1, iTunes for Windows 12.9.5, iCloud for Windows 7.12. A maliciously crafted SQL query may lead to arbitrary code execution...

CVE-2019-8600

A memory corruption issue was addressed with improved input validation. This issue is fixed in iOS 12.3, macOS Mojave 10.14.5, tvOS 12.3, watchOS 5.2.1, iTunes for Windows 12.9.5, iCloud for Windows 7.12. A maliciously crafted SQL query may lead to arbitrary code execution...

Memory corruption

A memory corruption issue was addressed with improved input validation. This issue is fixed in iOS 12.3, macOS Mojave 10.14.5, tvOS 12.3, watchOS 5.2.1, iTunes for Windows 12.9.5, iCloud for Windows 7.12. A maliciously crafted SQL query may lead to arbitrary code execution...

EUVD-2019-17990

A memory corruption issue was addressed with improved input validation. This issue is fixed in iOS 12.3, macOS Mojave 10.14.5, tvOS 12.3, watchOS 5.2.1, iTunes for Windows 12.9.5, iCloud for Windows 7.12. A maliciously crafted SQL query may lead to arbitrary code execution...

CVE-2019-8600

A memory corruption issue was addressed with improved input validation. This issue is fixed in iOS 12.3, macOS Mojave 10.14.5, tvOS 12.3, watchOS 5.2.1, iTunes for Windows 12.9.5, iCloud for Windows 7.12. A maliciously crafted SQL query may lead to arbitrary code execution...

PT-2019-19113

Name of the Vulnerable Software and Affected Versions iOS versions prior to 12.3 macOS Mojave versions prior to 10.14.5 tvOS versions prior to 12.3 watchOS versions prior to 5.2.1 iTunes for Windows versions prior to 12.9.5 iCloud for Windows versions prior to 7.12 Description A memory corruption...

ZingBox Inspector SQL Injection Information Disclosure

The vulnerability of the ZingBox Inspector network traffic processor is related to the lack of measures taken to protect the SQL query structure. Exploiting this vulnerability can allow a malicious actor to disclose the protected information remotely...

Django HStoreField JSONField SQL Injection

The vulnerability of the django.contrib.postgresfields.HStoreField and django.contrib.postgresfields.JSONField functions in the Django web development framework is related to conversion and key search errors, as well as index searching issues. Exploiting this vulnerability can allow an attacker t...