94 matches found
TDengine 数字错误漏洞
TDengine is an open-source, high-performance, cloud-native time series database developed by the TDengine company. There are digital error vulnerabilities in the TDengine 3.4.0.0 to 3.4.1.5 version. These vulnerabilities stem from unverified remote attackers sending specially crafted RPC packets,...
GHSA-H9FJ-C2QR-76G2 FUXA has SQL Injection in its TDengine DAQ connector via backslash bypass of escapeTdString
Summary The TDengine DAQ storage connector's escapeTdString at server/runtime/storage/tdengine/index.js:10 doubles single quotes but does not escape backslashes. TDengine's SQL parser treats ' as a literal single quote inside a string, so a tag id of the form x' OR 1=1-- escapes the first single...
FUXA has SQL Injection in its TDengine DAQ connector via backslash bypass of escapeTdString
Summary The TDengine DAQ storage connector's escapeTdString at server/runtime/storage/tdengine/index.js:10 doubles single quotes but does not escape backslashes. TDengine's SQL parser treats ' as a literal single quote inside a string, so a tag id of the form x' OR 1=1-- escapes the first single...
PT-2026-47570
Summary The TDengine DAQ storage connector's escapeTdString at server/runtime/storage/tdengine/index.js:10 doubles single quotes but does not escape backslashes. TDengine's SQL parser treats ' as a literal single quote inside a string, so a tag id of the form x' OR 1=1-- escapes the first single...
PT-2026-47617
Name of the Vulnerable Software and Affected Versions FUXA versions prior to 1.3.2 Description The TDengine DAQ storage connector contains a flaw in the escapeTdString function located in server/runtime/storage/tdengine/index.js. While the function doubles single quotes, it fails to escape...
tdengine:sql-fuzzer: Stack-buffer-overflow in MurmurHash3_32
Detailed Report: https://oss-fuzz.com/testcase?key=6521509010276352 Project: tdengine Fuzzing Engine: libFuzzer Fuzz Target: sql-fuzzer Job Type: libfuzzerasantdengine Platform Id: linux Crash Type: Stack-buffer-overflow READ 4 Crash Address: 0x75e590dd032c Crash State: MurmurHash332 taosHashPut...
tdengine:sql-fuzzer: Stack-buffer-overflow in ___interceptor_strncpy
Detailed Report: https://oss-fuzz.com/testcase?key=4804119796973568 Project: tdengine Fuzzing Engine: libFuzzer Fuzz Target: sql-fuzzer Job Type: libfuzzerasantdengine Platform Id: linux Crash Type: Stack-buffer-overflow WRITE Crash Address: 0x7879695d028d Crash State: interceptorstrncpy buildDbR...
tdengine:sql-fuzzer: Global-buffer-overflow in tGetToken
Detailed Report: https://oss-fuzz.com/testcase?key=4570542010335232 Project: tdengine Fuzzing Engine: libFuzzer Fuzz Target: sql-fuzzer Job Type: libfuzzerasantdengine Platform Id: linux Crash Type: Global-buffer-overflow READ 1 Crash Address: 0x593d27421655 Crash State: tGetToken...
tdengine:sql-fuzzer: Global-buffer-overflow in tGetToken
Detailed Report: https://oss-fuzz.com/testcase?key=4807015468957696 Project: tdengine Fuzzing Engine: afl Fuzz Target: sql-fuzzer Job Type: aflasantdengine Platform Id: linux Crash Type: Global-buffer-overflow READ 1 Crash Address: 0x563c8298c4e8 Crash State: tGetToken parse qParseSqlSyntax...
EUVD-2023-42306
Malicious code in bioql PyPI...
CVE-2023-38502
TDengine is an open source, time-series database optimized for Internet of Things devices. Prior to version 3.0.7.1, TDengine DataBase crashes on UDF nested query. This issue affects TDengine Databases which let users connect and run arbitrary queries. Version 3.0.7.1 has a patch for this issue...
Denial Of Service (DoS)
github.com/taosdata/TDengine is vulnerable to Denial Of Service DoS. The vulnerability exists due to the improper input validation of the library, which allows an attacker with the create function privilege to crash the application by providing a maliciously crafted UDF nested query...
CVE-2023-38502
TDengine is an open source, time-series database optimized for Internet of Things devices. Prior to version 3.0.7.1, TDengine DataBase crashes on UDF nested query. This issue affects TDengine Databases which let users connect and run arbitrary queries. Version 3.0.7.1 has a patch for this issue...
Design/Logic Flaw
TDengine is an open source, time-series database optimized for Internet of Things devices. Prior to version 3.0.7.1, TDengine DataBase crashes on UDF nested query. This issue affects TDengine Databases which let users connect and run arbitrary queries. Version 3.0.7.1 has a patch for this issue...
CVE-2023-38502 TDengine Database Denial-of-Service
TDengine is an open source, time-series database optimized for Internet of Things devices. Prior to version 3.0.7.1, TDengine DataBase crashes on UDF nested query. This issue affects TDengine Databases which let users connect and run arbitrary queries. Version 3.0.7.1 has a patch for this issue...
CVE-2023-38502
CVE-2023-38502 describes a Denial-of-Service in TDengine prior to 3.0.7.1 caused by an input validation issue that makes the database crash when evaluating a UDF nested query. A patch exists in version 3.0.7.1. Affected products are TDengine databases that allow arbitrary query execution; the roo...
CVE-2023-38502 TDengine Database Denial-of-Service
TDengine is an open source, time-series database optimized for Internet of Things devices. Prior to version 3.0.7.1, TDengine DataBase crashes on UDF nested query. This issue affects TDengine Databases which let users connect and run arbitrary queries. Version 3.0.7.1 has a patch for this issue...
CVE-2023-38502 TDengine Database Denial-of-Service
TDengine is an open source, time-series database optimized for Internet of Things devices. Prior to version 3.0.7.1, TDengine DataBase crashes on UDF nested query. This issue affects TDengine Databases which let users connect and run arbitrary queries. Version 3.0.7.1 has a patch for this issue...
TDengine 输入验证错误漏洞
TDengine is an open source, high performance, cloud-native time series database from TDengine. An input validation error vulnerability exists in versions prior to TDengine 3.0.7.1, which stems from the database crashing on a UDF nested query resulting in a denial of service, allowing an attacker ...
CVE-2023-38502: Improper Input Validation
TDengine is an open source, time-series database optimized for Internet of Things devices. Prior to version 3.0.7.1, TDengine DataBase crashes on UDF nested query. This issue affects TDengine Databases which let users connect and run arbitrary queries. Version 3.0.7.1 has a patch for this issue...