CVE-2024-9537

CVE-2024-9537 affects ScienceLogic SL1 (EM7) via an unspecified vulnerability in a third‑party component bundled with SL1. Evidence from connected documents confirms remote code execution risk with observed in‑the‑wild activity and active exploitation. Remediation provided: SL1 versions 12.1.3+, ...

CVE-2022-48581

CVE-2022-48581 affects ScienceLogic SL1 via the dash export feature, where unsanitized user input is passed to a shell command, enabling command injection. Affected component is the dash export path in SL1 (ScienceLogic software); underlying cause is unsanitized input reaching the shell. Document...

CVE-2022-48589

CVE-2022-48589 is a SQL injection vulnerability in the ScienceLogic SL1 platform, specifically in the “reporting job editor” that unsafely passes user-controlled input to SQL queries. Affected component is SL1’s reporting job editor; root cause is unsanitized input reaching the database. The NVD ...

CVE-2022-48600

CVE-2022-48600 is a SQL injection vulnerability in the notes view feature of ScienceLogic SL1. The flaw accepts unsanitized user-controlled input which is passed directly to a SQL query, enabling arbitrary SQL execution against the database. Documents indicate the issue affects SL1 versions up to...

CVE-2022-48595

ScienceLogic SL1 is affected by a SQL injection in the ticket template watchers feature. The vulnerability arises from unsanitized user-controlled input being passed directly to SQL queries, enabling injection of arbitrary SQL against the backend database. Known details indicate affected software...

CVE-2022-48590

CVE-2022-48590 affects ScienceLogic SL1, specifically the admin dynamic app mib errors feature. The root cause is unsanitized user-controlled input being passed directly into a SQL query, enabling SQL injection. Impact is high on confidentiality, integrity, and availability, with CVSSv3.1 base sc...

CVE-2022-48599

ScienceLogic SL1 is affected by a SQL injection in the reporter events type feature, where unsanitized user input is passed directly into a SQL query. The vulnerability arises from improper input handling in the reporter events type function, enabling arbitrary SQL execution against the database....

CVE-2022-48603

The CVE-2022-48603 entry describes a SQL injection vulnerability in ScienceLogic SL1’s “message viewer iframe” feature, where unsanitized user input is passed directly into a SQL query. Affected component: ScienceLogic SL1 (message viewer iframe). Root cause: lack of input sanitization before SQL...

CVE-2022-48584

CVE-2022-48584 describes a command-injection in ScienceLogic SL1’s Download and Convert Reports feature. The vulnerability stems from unsanitized user-controlled input being passed to a shell command, enabling arbitrary command execution on the underlying OS. Documents specify affected software a...

CVE-2022-48586

CVE-2022-48586 is a SQL injection vulnerability in the “json walker” feature of ScienceLogic SL1. The issue arises when unsanitized, user-controlled input is passed directly to a SQL query, enabling arbitrary SQL execution against the database. Connected sources corroborate a vulnerability in SL1...

CVE-2022-48592

ScienceLogic SL1 has a SQL injection in the vendor_country/vendor country parameter of the “vendor print report” feature, caused by unsanitized user input passed directly to a SQL query. The related connected sources confirm vulnerable input handling and SQL execution, impacting confidentiality a...

CVE-2022-48594

The CVE-2022-48594 entry concerns ScienceLogic SL1, specifically the ticket watchers email feature. The vulnerability arises because unsanitized user-controlled input is passed directly into a SQL query, enabling SQL injection. Affected software is ScienceLogic SL1; the vulnerability is rooted in...

CVE-2022-48585

CVE-2022-48585 maps to a SQL injection in the ScienceLogic SL1 admin brand portal. The vulnerability arises from unsanitized user input being passed directly to a SQL query, enabling arbitrary SQL execution. Multiple connected sources corroborate this weakness and describe affected software as Sc...

CVE-2022-48602

CVE-2022-48602 describes a SQL injection in ScienceLogic SL1's “message viewer print” feature, where unsanitized user-controlled input is passed directly to a SQL query. The affected product is ScienceLogic SL1; the vulnerability stems from lack of input validation in that function, enabling inje...

CVE-2022-48582

CVE-2022-48582 describes a command-injection vulnerability in the ticket report generation feature of ScienceLogic SL1 that accepts unsanitized user-controlled input and passes it to a shell command. This allows arbitrary commands to be executed on the underlying OS, with a CVSS v3.1 base score o...

CVE-2022-48588

CVE-2022-48588 is a confirmed SQL injection vulnerability in the “schedule editor decoupled” feature of ScienceLogic SL1 . Multiple connected sources (e.g., Red Hat CVE entry, CNVD-2023-66420, and others) describe that unsanitized, user-controlled input is passed directly into a SQL query, enabli...

CVE-2022-48596

Affected software: ScienceLogic SL1. Vulnerability: SQL injection in the “ticket queue watchers” feature that uses unsanitized user input directly in SQL queries. Impact (as described): potential of injecting arbitrary SQL into the database; high severity per CVE metrics. Versions/scope: reports ...

CVE-2022-48587

CVE-2022-48587 affects ScienceLogic SL1, where the schedule editor passes unsanitized user input directly into SQL queries, enabling SQL injection. The vulnerability is confirmed across multiple sources/specifications and has a CVSS v3.1 base score of 8.8 (HIGH) with network attack vector, low at...

CVE-2022-48591

CVE-2022-48591 describes a SQL injection in the ScienceLogic SL1 product, arising from the vendor_state parameter used by the “vendor print report” feature. The vulnerability occurs when unsanitized user input is passed directly into a SQL query, allowing arbitrary SQL execution against the datab...

CVE-2022-48593

CVE-2022-48593 affects ScienceLogic SL1, specifically theTopology Data Service feature, where unsanitized user input is passed directly into a SQL query, enabling SQL injection. Public sources consistently describe this as a high-severity, network-based risk with high confidentiality, integrity, ...

CVE-2022-48597

CVE-2022-48597 describes a SQL injection in ScienceLogic SL1, specifically in the “ticket event report” feature where unsanitized, user-controlled input is passed directly to a SQL query. The root cause is lack of input sanitization/validation in that feature, enabling arbitrary SQL execution aga...

CVE-2022-48598

ScienceLogic SL1 is affected by a SQL injection in the reporter events type date feature, caused by unsanitized user input passed directly to SQL queries. Root cause: lack of input validation/escaping. Impact: high on confidentiality, integrity, and availability per CVSS 3.1. A fix/affected versi...

CVE-2022-48580

Summary: CVE-2022-48580 describes a command injection vulnerability in the ARP ping device tool feature of ScienceLogic SL1. The root cause is unsanitized user-controlled input that is passed directly to a shell command, enabling arbitrary commands to run on the underlying OS. Impact (as stated):...

CVE-2022-48583

CVE-2022-48583 affects ScienceLogic SL1, specifically the dashboard scheduler component. The vulnerability arises from unsanitized user input being passed directly to a shell command, enabling command injection on the underlying OS. Affected information from connected sources confirms this is a u...

CVE-2022-48604

CVE-2022-48604 affects ScienceLogic SL1, with a SQL injection in the “logging export” feature where unsanitized user input is passed into a SQL query. Multiple sources (including CNNVD and Red Hat) indicate vulnerable versions include SL1 up to at least 11.1.2 (and prior); PT-Security notes no ex...

CVE-2022-48601

CVE-2022-48601 describes a SQL injection in the ScienceLogic SL1 product, specifically the network print report feature where unsanitized input is passed directly to a SQL query. The vulnerability is documented with a high impact (CVSS 3.1 base score 8.8) and network access with low privileges. C...