1530 matches found
5 Steps for Dealing With Unknown Environments in InsightVM
Trying to deal with a large network can be difficult. All too often, engineers and admins don't know the full scope of their environment and have trouble defining the actual subnets and the systems that exist on those subnets. They know of a couple /24 subnets here or there, but it's very possibl...
The vulnerability in the open-source e-commerce web application PrestaShop relates to the lack of measures taken to protect the SQL query structure, allowing an attacker to execute arbitrary code.
The vulnerability in the open-source e-commerce web application PrestaShop relates to the lack of measures taken to protect the SQL query structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...
CVE-2022-35864
This vulnerability allows remote attackers to disclose sensitive information on affected installations of BMC Track-It! 20.21.02.109. Authentication is required to exploit this vulnerability. The specific flaw exists within the GetPopupSubQueryDetails endpoint. The issue results from the lack of...
CVE-2022-34968
An issue in the fetchstep function in Percona Server for MySQL v8.0.28-19 allows attackers to cause a Denial of Service DoS via a SQL query...
Design/Logic Flaw
An issue in the fetchstep function in Percona Server for MySQL v8.0.28-19 allows attackers to cause a Denial of Service DoS via a SQL query...
CVE-2022-34968
An issue in the fetchstep function in Percona Server for MySQL v8.0.28-19 allows attackers to cause a Denial of Service DoS via a SQL query...
PT-2022-22463 · Percona · Percona Server For Mysql
Name of the Vulnerable Software and Affected Versions: Percona Server for MySQL version 8.0.28-19 Description: An issue in the fetch step function allows attackers to cause a Denial of Service DoS via a SQL query. Recommendations: For Percona Server for MySQL version 8.0.28-19, consider disabling...
The vulnerability of the FUEL CMS content management system lies in the lack of protection for SQL query structures, which allows attackers to compromise the confidentiality, integrity, and accessibility of the protected information.
The vulnerability of the FUEL CMS content management system lies in the lack of protection for the SQL query structure. Exploiting this vulnerability allows a malicious actor to compromise the confidentiality, integrity, and accessibility of the protected information through the col parameter in...
Translatepress Multilinugal < 2.3.3 - Admin+ SQLi
The plugin is vulnerable to an authenticated SQL injection. By adding a new language via the settings page containing specific special characters, the backticks in the SQL query can be surpassed and a time-based blind payload can be injected. PoC To exploit the vulnerability, someone must send a...
PT-2022-22975 · Bmc · Bmc Track-It!
Name of the Vulnerable Software and Affected Versions: BMC Track-It! version 20.21.02.109 Description: This issue allows remote attackers to disclose sensitive information on affected installations. Authentication is required to exploit this issue. The specific flaw exists within the...
SQL Injection
francoisjacquet/rosariosis is vulnerable to SQL injection. It does not escape the input DB identifier in RegistrationSave.fnc.php, Calendar.php, MarkingPeriods.php, SchoolFields.php, AddressFields.php, PeopleFields.php, StudentFields.php & UserFields.php, allowing an attacker to inject malicious...
Ivanti Avalanche EnterpriseServer Service SQL Injection Authentication Bypass Vulnerability
This vulnerability allows remote attackers to bypass authentication on affected installations of Ivanti Avalanche. The specific flaw exists within the ProfileDaoImpl class. A crafted request can trigger execution of SQL queries composed from a user-supplied string. An attacker can leverage this...
Ivanti Avalanche EnterpriseServer Service SQL Injection Authentication Bypass Vulnerability
This vulnerability allows remote attackers to bypass authentication on affected installations of Ivanti Avalanche. The specific flaw exists within the GroupDaoImpl class. A crafted request can trigger execution of SQL queries composed from a user-supplied string. An attacker can leverage this...
GHSA-C8WV-QWWC-6J73 MediaWiki allows a denial of service
MediaWiki before 1.36.2 allows a denial of service resource consumption because of lengthy query processing time. Visiting Special:Contributions can sometimes result in a long running SQL query because PoolCounter protection is mishandled...
MediaWiki allows a denial of service
MediaWiki before 1.36.2 allows a denial of service resource consumption because of lengthy query processing time. Visiting Special:Contributions can sometimes result in a long running SQL query because PoolCounter protection is mishandled...
Bookstack Cross-site Scripting vulnerability
In BookStack before version 0.30.4, a user with permissions to edit a page could insert JavaScript code through the use of javascript: URIs within a link or form which would run, within the context of the current page, when clicked or submitted. Additionally, a user with permissions to edit a pag...
GHSA-CH37-CH8W-CFRQ Bookstack Cross-site Scripting vulnerability
In BookStack before version 0.30.4, a user with permissions to edit a page could insert JavaScript code through the use of javascript: URIs within a link or form which would run, within the context of the current page, when clicked or submitted. Additionally, a user with permissions to edit a pag...
GHSA-9J9H-CPGC-8356 phpMyAdmin vulnerable to Cross-site Scripting
Multiple cross-site scripting XSS vulnerabilities in phpMyAdmin 3.4.x before 3.4.8 allow remote attackers to inject arbitrary web script or HTML via 1 a crafted database name, related to the Database Synchronize panel; 2 a crafted database name, related to the Database rename panel; 3 a crafted S...
phpMyAdmin vulnerable to Cross-site Scripting
Multiple cross-site scripting XSS vulnerabilities in phpMyAdmin 3.4.x before 3.4.8 allow remote attackers to inject arbitrary web script or HTML via 1 a crafted database name, related to the Database Synchronize panel; 2 a crafted database name, related to the Database rename panel; 3 a crafted S...
The vulnerability in the web interface of the Cisco Unified Communications Manager IM & Presence Service allows a perpetrator to execute arbitrary SQL queries.
The vulnerability of the Web interface for managing the Cisco Unified Communications Manager IM & Presence Service Unified CM IM&P is related to the lack of measures taken to protect the SQL query structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary SQL queries...