EUVD-2022-0149

Malicious code in bioql PyPI...

Alibaba Cloud Linux 3 : 0057: python-mako (ALINUX3-SA-2023:0057)

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by a vulnerability as referenced in the ALINUX3-SA-2023:0057 advisory. Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities: CVE-2022-40023: Sqlalchemy mako before 1.2.2 is...

CVE-2024-34715

CVE-2024-34715 affects the Fides webserver, where an improper escaping of the SQLAlchemy password string can cause the database password to be partially exposed in webserver logs when the password contains characters like @ or $. This is due to insufficient escaping of the password in the connect...

ads-api (>=0.1.7.3 <=0.1.7.5), aequitas (>=0.26.0 <=0.34.0) +217 more potentially affected by CVE-2019-7164 via sqlalchemy (>=0.7.7 <=1.3.0b2)

sqlalchemy PYPI version =0.7.7, =0.1.7.3, =0.26.0, =0.1.0, =1.10.0, =0.10.0, =1.10.3, =0.1.6, =1.0.0a0, =1.0.0, =0.0.4, =1.0.1, =0.6.7.post3, =0.0.2, =0.0.9 and more Source cves: CVE-2019-7164 Source advisory: OSV:GHSA-887W-45RQ-VXGF...

SQLAlchemy is vulnerable to SQL Injection via group_by parameter

SQLAlchemy 1.2.17 has SQL Injection when the groupby parameter can be controlled...

aequitas (>=0.26.0 <=0.34.0), alembic-viz (=0.1.0) +152 more potentially affected by CVE-2019-7548 via sqlalchemy (>=0.7.7 <=1.2.18)

sqlalchemy PYPI version =0.7.7, =0.26.0, =1.10.0, =0.10.0, =0.1.6, =1.0.0a0, =1.0.0, =0.0.4, =1.0.1, =0.6.7.post3, =0.0.2, =0.0.2, =0.0.2, =0.0.4, =0.0.6 and more Source cves: CVE-2019-7548 Source advisory: OSV:GHSA-38FC-9XQV-7F7Q...

DEBIAN-CVE-2019-7548

SQLAlchemy 1.2.17 has SQL Injection when the groupby parameter can be controlled...

PYSEC-2019-124

SQLAlchemy 1.2.17 has SQL Injection when the groupby parameter can be controlled...

python-sqlalchemy: SQL injection flaw due to not checking LIMIT input for correct type

Multiple SQL injection vulnerabilities in SQLAlchemy before 0.7.0b4, as used in Keystone, allow remote attackers to execute arbitrary SQL commands via the 1 limit or 2 offset keyword to the select function, or unspecified vectors to the 3 select.limit or 4 select.offset function...