SQL Injection

z-push/z-push-dev is vulnerable to SQL Injection. The vulnerability is due to unparameterized queries in the IMAP backend’s basic authentication username field, which allows an attacker to inject malicious SQL commands to access, modify, or delete sensitive data from a linked third-party database...

CVE-2025-8264

Versions of the package z-push/z-push-dev before 2.7.6 are vulnerable to SQL Injection due to unparameterized queries in the IMAP backend. An attacker can inject malicious commands by manipulating the username field in basic authentication. This allows the attacker to access and potentially modif...

CVE-2020-16104

SQL Injection vulnerability in Enterprise Data Interface of Gallagher Command Centre allows a remote attacker with 'Edit Enterprise Data Interfaces' privilege to execute arbitrary SQL against a third party database if EDI is configured to import data from this database. This issue affects:...

Drupal core - Moderately critical - Gadget chain - SA-CORE-2024-008

Drupal core contains a potential PHP Object Injection vulnerability that if combined with another exploit could lead to Remote Code Execution. It is not directly exploitable. This issue is mitigated by the fact that in order for it to be exploitable, a separate vulnerability must be present to...

CVE-2020-16104

SQL Injection vulnerability in Enterprise Data Interface of Gallagher Command Centre allows a remote attacker with 'Edit Enterprise Data Interfaces' privilege to execute arbitrary SQL against a third party database if EDI is configured to import data from this database. This issue affects:...

Sql injection

SQL Injection vulnerability in Enterprise Data Interface of Gallagher Command Centre allows a remote attacker with 'Edit Enterprise Data Interfaces' privilege to execute arbitrary SQL against a third party database if EDI is configured to import data from this database. This issue affects:...

PT-2020-14756

Name of the Vulnerable Software and Affected Versions Gallagher Command Centre versions prior to 8.30.1236MR1 Gallagher Command Centre versions prior to 8.20.1166MR3 Gallagher Command Centre versions prior to 8.10.1211MR5 Gallagher Command Centre versions prior to 8.00.1228MR6 Gallagher Command...

CVE-2020-16104: Improper Neutralization of Special Elements used in an SQL Command

SQL Injection vulnerability in Enterprise Data Interface of Gallagher Command Centre allows a remote attacker with 'Edit Enterprise Data Interfaces' privilege to execute arbitrary SQL against a third party database if EDI is configured to import data from this database. This issue affects:...

CVE-2013-6800

An unspecified third-party database module for the Key Distribution Center KDC in MIT Kerberos 5 aka krb5 1.10.x allows remote authenticated users to cause a denial of service NULL pointer dereference and daemon crash via a crafted request, a different vulnerability than CVE-2013-1418...

PT-2013-1201

Name of the Vulnerable Software and Affected Versions MIT Kerberos 5 aka krb5 versions 1.10.x through 1.11.3 Description The issue affects the Key Distribution Center KDC in MIT Kerberos 5 due to an unspecified third-party database module. It allows remote authenticated users to cause a denial of...

Active Inbound Connection From Host Listed in Known Bot Database

This plugin has been temporarily disabled. According to the output from netstat, the remote host has an inbound connection from one or more hosts that are listed in a public database as part of a botnet. C Tenable Network Security, Inc. @DEPRECATED@ Disabled on 2018/08/14. Disabling threat feed...

CVE-2002-2301

Lawson Financials 8.0, when configured to use a third party relational database, stores usernames and passwords in a world-readable file, which allows local users to read the passwords and log onto the database...