PT-2022-24930 · Metabase · Metabase

Name of the Vulnerable Software and Affected Versions: Metabase versions prior to 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, 1.42.6, 0.41.9, and 1.41.9 Description: The issue concerns the automatic execution of unsaved SQL queries, which could pose a possible attack vector. Metabase has addressed th...

CVE-2022-39362

Metabase is affected by CVE-2022-39362 due to unsafely auto-executing unsaved/native SQL queries in certain older releases. Affected versions include 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, 1.42.6, 0.41.9, and 1.41.9 (prior to patch). The underlying issue allowed native queries to be executed aut...

ERP system Processlogin.php Code Execution

The vulnerability of the processlogin.php implementation in the ERP system is related to the lack of measures taken to protect the SQL query structure during the processing of the user argument. Exploiting this vulnerability allows an attacker operating remotely to execute arbitrary code...

CVE-2021-44835: Improper Neutralization of Special Elements used in an SQL Command

An issue was discovered in Active Intelligent Visualization 5. The Vdc header is used in a SQL query without being sanitized. This causes SQL injection...

5 Steps for Dealing With Unknown Environments in InsightVM

Trying to deal with a large network can be difficult. All too often, engineers and admins don't know the full scope of their environment and have trouble defining the actual subnets and the systems that exist on those subnets. They know of a couple /24 subnets here or there, but it's very possibl...

PrestaShop SQL Injection

The vulnerability in the open-source e-commerce web application PrestaShop relates to the lack of measures taken to protect the SQL query structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

osquery:osqueryfuzz-sqlquery: Heap-buffer-overflow in sqlite3VdbeExec

Project: https://github.com/osquery/osquery.git Detailed Report: https://oss-fuzz.com/testcase?key=4965150242766848 Project: osquery Fuzzing Engine: afl Fuzz Target: osqueryfuzz-sqlquery Job Type: aflasanosquery Platform Id: linux Crash Type: Heap-buffer-overflow READ Crash Address: 0x6160000254f...

CVE-2022-35864

This vulnerability allows remote attackers to disclose sensitive information on affected installations of BMC Track-It! 20.21.02.109. Authentication is required to exploit this vulnerability. The specific flaw exists within the GetPopupSubQueryDetails endpoint. The issue results from the lack of...

CVE-2022-34968

An issue in the fetchstep function in Percona Server for MySQL v8.0.28-19 allows attackers to cause a Denial of Service DoS via a SQL query...

Design/Logic Flaw

An issue in the fetchstep function in Percona Server for MySQL v8.0.28-19 allows attackers to cause a Denial of Service DoS via a SQL query...

CVE-2022-34968

An issue in the fetchstep function in Percona Server for MySQL v8.0.28-19 allows attackers to cause a Denial of Service DoS via a SQL query...

CVE-2022-34968

An issue in the fetchstep function in Percona Server for MySQL v8.0.28-19 allows attackers to cause a Denial of Service DoS via a SQL query...

PT-2022-22463 · Percona · Percona Server For Mysql

Name of the Vulnerable Software and Affected Versions: Percona Server for MySQL version 8.0.28-19 Description: An issue in the fetch step function allows attackers to cause a Denial of Service DoS via a SQL query. Recommendations: For Percona Server for MySQL version 8.0.28-19, consider disabling...

FUEL CMS SQL Injection

The vulnerability of the FUEL CMS content management system lies in the lack of protection for the SQL query structure. Exploiting this vulnerability allows a malicious actor to compromise the confidentiality, integrity, and accessibility of the protected information through the col parameter in...

Translatepress Multilinugal < 2.3.3 - Admin+ SQLi

The plugin is vulnerable to an authenticated SQL injection. By adding a new language via the settings page containing specific special characters, the backticks in the SQL query can be surpassed and a time-based blind payload can be injected. PoC To exploit the vulnerability, someone must send a...

PT-2022-22975 · Bmc · Bmc Track-It!

Name of the Vulnerable Software and Affected Versions: BMC Track-It! version 20.21.02.109 Description: This issue allows remote attackers to disclose sensitive information on affected installations. Authentication is required to exploit this issue. The specific flaw exists within the...

CVE-2022-26348: Improper Neutralization of Special Elements used in an SQL Command

Command Centre Server is vulnerable to SQL Injection via Windows Registry settings for date fields on the server. The Windows Registry setting allows an attacker using the Visitor Management Kiosk, an application designed for public use, to invoke an arbitrary SQL query that has been preloaded in...

PT-2022-4194

Name of the Vulnerable Software and Affected Versions Photonic Plugin affected versions not specified Description The issue is related to the lack of protection against SQL query structure exploitation in the Photonic Plugin. This could allow a remote attacker to put the database into a sleeping...

SQL Injection

francoisjacquet/rosariosis is vulnerable to SQL injection. It does not escape the input DB identifier in RegistrationSave.fnc.php, Calendar.php, MarkingPeriods.php, SchoolFields.php, AddressFields.php, PeopleFields.php, StudentFields.php & UserFields.php, allowing an attacker to inject malicious...

PT-2022-3400

Name of the Vulnerable Software and Affected Versions Online Fire Reporting System version 1.0 Description The issue is related to a lack of protection against SQL query structure exploitation. An attacker can execute arbitrary SQL queries via the "/ofrs/admin/?page=requests/manage request&id=" A...