MonikaBrzica scm security vulnerability

scm is a supply chain management software by MonikaBrzica Individual Developer. A security vulnerability exists in MonikaBrzica scm, which stems from some unknown function of its upisubazu.php component that operates on the email/lozinka/ime/id parameter, leading to an attacker to implement SQL...

CVE-2022-43288

Rukovoditel v3.2.1 was discovered to contain a SQL injection vulnerability via the orderby parameter at /rukovoditel/index.php?module=logs/view&type=php...

HHIMS SQL injection vulnerability

HHIMS is a free, open source software system from the individual developers at TSRuban. It is used to store and retrieve simple patient medical records. HHIMS suffers from a SQL injection vulnerability that originates from an unknown function in the scenegraph/svgattributes.c file of the SVG Pars...

Arches SQL injection vulnerability

Arches is an Arches open source web platform for creating, managing and visualizing geospatial data. A security vulnerability exists in Arches versions prior to 6.1.2, 6.2.1, and 7.1.2, which stems from an attacker being able to implement SQL injection via a crafted web request...

Delta Electronics DIAEnergie SQL injection vulnerability

Delta Electronics DIAEnergie is an industrial energy management system from Delta Electronics Taiwan, China used to monitor and analyze energy consumption in real time, calculate energy consumption and load characteristics, optimize equipment performance, improve production processes and maximize...

Online Diagnostic Lab Management System SQL Injection Vulnerability

Online Diagnostic Lab Management System is an online diagnostic lab management system. A security vulnerability exists in Online Diagnostic Lab Management System v1.0, which was discovered to contain an SQL injection vulnerability via the id parameter on /odlms//classes/Master.php?f=deleteactivit...

CVE-2022-39069

There is a SQL injection vulnerability in ZTE ZAIP-AIE. Due to lack of input verification by the server, an attacker could trigger an attack by building malicious requests. Exploitation of this vulnerability could cause the leakage of the current table content...

ALSA-2022:7464 Moderate: protobuf security update

The protobuf packages provide Protocol Buffers, Google's data interchange format. Protocol Buffers can encode structured data in an efficient yet extensible format, and provide a flexible, efficient, and automated mechanism for serializing structured data. Security Fixes: protobuf: Incorrect...

Schneider Electric EcoStruxure Operator Terminal Expert SQL injection vulnerability

Schneider Electric EcoStruxure Operator Terminal Expert is a touch screen configuration software from Schneider Electric, France. This software support is mainly used to create and edit touch applications. A SQL injection vulnerability exists in Schneider Electric EcoStruxure Operator Terminal...

UBUNTU-CVE-2022-39323

GLPI stands for Gestionnaire Libre de Parc Informatique. GLPI is a Free Asset and IT Management Software package that provides ITIL Service Desk features, licenses tracking and software auditing. Time based attack using a SQL injection in api REST usertoken. This issue has been patched, please...

Official Car Rental System Bypass Security Restrictions

The vulnerability in the implementation of the account.php, login.php, and bookcar.php scripts of the Official Car Rental System relates to the lack of measures taken to protect the SQL query structure when processing parameters such as uname, pass, and id. Exploiting this vulnerability allows a...

CISA Upgrades to TLP 2.0

Today, CISA officially upgraded to Traffic Light Protocol TLP 2.0, which facilitates greater information sharing and collaboration. CISA made this upgrade in accordance with the recommendation from the Forum of Incident Response and Security Teams to upgrade to TLP 2.0 by January 2023. Key TLP 2....

Online Diagnostic Lab Management System SQL Injection Vulnerability

Online Diagnostic Lab Management System is an online diagnostic lab management system. v1.0 of Online Diagnostic Lab Management System is vulnerable to SQL injection, which stems from a lack of validation of externally entered SQL statements and can be exploited by attackers to to obtain sensitiv...

Canteen Management System SQL Injection Vulnerability

Canteen Management System is a cafeteria management system by Mayuri K. Individual developer. A SQL injection vulnerability exists in Canteen Management System version 1.0, which stems from the userid parameter of /phpaction/fetchOrderData.php being susceptible to SQL injection...

Seccome Ehoney security vulnerability

seccome Ehoney is a secure, fast, highly interactive, enterprise-class honeypot management system open-sourced by China seccome. seccome Ehoney has a security vulnerability , the vulnerability stems from its file /api/v1/attack/token in the unknown function of the parameter Payload operation lead...

Online Medicine Ordering System Security Vulnerabilities

Online Medicine Ordering System is an online medicine ordering system by Carlo Montero, an individual developer. A security vulnerability exists in version 1.0 of the Online Medicine Ordering System due to an unknown function in its admin/?page=orders/vieworder file that operates on the parameter...

PT-2022-24929 · Metabase · Metabase

Name of the Vulnerable Software and Affected Versions: Metabase versions prior to 0.41.9, 0.42.6, 0.43.7, 0.44.5, 1.41.9, 1.42.6, 1.43.7, and 1.44.5 Description: The issue allows Remote Code Execution RCE in Metabase, a data visualization software, when users can write SQL queries on H2 databases...

Delta Electronics DIAEnergie SQL injection vulnerability

Delta Electronics DIAEnergie is an industrial energy management system for monitoring and analyzing energy consumption in real time, calculating energy consumption and load characteristics, optimizing equipment performance, improving production processes and maximizing energy efficiency. A securi...

Metabase security vulnerabilities

Metabase is an open source data analytics platform from Metabase, Inc. in the United States. A security vulnerability exists in Metabase that stems from the fact that H2 the example database can allow Remote Code Execution RCE, which can be abused by users who are able to write SQL queries on the...

Johnson Controls CKS CEVAS Cross-Site Scripting Vulnerability

Johnson Controls CKS CEVAS is a web-based billing and reporting solution from Johnson Controls, Inc. It is used for rescue and emergency services. A security vulnerability exists in Johnson Controls CKS CEVAS versions prior to 1.01.46. An attacker exploited the vulnerability to retrieve data via ...