WaratekVRT Sign in
Reset
More filters (2)
Columns
ARMR rules: SQL injection✕Published to 2017-12-31✕
Overview 18 matches · 0 exploited · 0 CISA KEV · 4 public PoC · 1 EPSS ≥ 0.5
18matches 0exploited0.0% 0CISA KEV0.0% 4public PoC22.2% 1EPSS ≥ 0.55.6%
Protected by Waratek 18 100.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 0 0.0%
Critical 3 16.7% High 9 50.0% Medium 5 27.8% Low 1 5.6% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 18 100.0% partly blocked 0 0.0% not blocked 0 0.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 0 0.0% Working exploit published 4 22.2% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 14 77.8%
split by peak 4 / year
Protected by Waratek: 18 Low: 1Medium: 5High: 9Critical: 3 blocked by ARMR today: 18 No public exploit: 14Working exploit published: 4
20021 Protected by Waratek1 High1 blocked by ARMR today1 No public exploit1 20030 20041 Protected by Waratek1 High1 blocked by ARMR today1 No public exploit1 20050 20061 Protected by Waratek1 High1 blocked by ARMR today1 No public exploit1 20072 Protected by Waratek2 High1 Medium1 blocked by ARMR today2 No public exploit2 20080 20090 20100 20111 Protected by Waratek1 Medium1 blocked by ARMR today1 No public exploit1 20121 Protected by Waratek1 High1 blocked by ARMR today1 No public exploit1 20132 Protected by Waratek2 High1 Medium1 blocked by ARMR today2 Working exploit published2 20140 20151 Protected by Waratek1 Low1 blocked by ARMR today1 No public exploit1 20164 Protected by Waratek4 Critical1 High2 Medium1 blocked by ARMR today4 Working exploit published1 No public exploit3 20174 Protected by Waratek4 Critical2 High1 Medium1 blocked by ARMR today4 Working exploit published1 No public exploit3
20032005200720092011201320152017
18 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2017-7681 High 2017-07-17 Protected by Waratek No public exploit Apache OpenMeetings 1.0.0 is vulnerable to SQL injection. This allows authenticated users to modify the structure of the existing query and leak the structure of other queries being made by the application in the back-end.
CVE-2017-4974 Medium 2017-06-13 Protected by Waratek No public exploit An issue was discovered in Cloud Foundry Foundation cf-release versions prior to v258; UAA release 2.x versions prior to v2.7.4.15, 3.6.x versions prior to v3.6.9, 3.9.x versions prior to v3.9.11, and other versions prior to v3.16.0; and UAA bosh release (uaa-release) 13.x versions prior to v13.13, 24.x versions prior to v24.8, and other versions prior to v30.1. An authorized user can use a blind SQL injection attack to query the contents of the UAA database, aka "Blind SQL Injection with privileged UAA endpoints."
CVE-2017-3549 Critical 2017-04-24 Protected by Waratek Working exploit published Vulnerability in the Oracle Scripting component of Oracle E-Business Suite (subcomponent: Scripting Administration). Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5 and 12.2.6. Easily "exploitable" vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Scripting. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Scripting accessible data as well as unauthorized access to critical data or complete access to all Oracle Scripting accessible data. CVSS 3.0 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).
CVE-2016-8027 Critical 2017-03-14 Protected by Waratek No public exploit SQL injection vulnerability in core services in Intel Security McAfee ePolicy Orchestrator (ePO) 5.3.2 and earlier and 5.1.3 and earlier allows attackers to alter a SQL query, which can result in disclosure of information within the database or impersonation of an agent without authentication via a specially crafted HTTP post.
CVE-2016-6652 Medium 2016-10-05 Protected by Waratek No public exploit SQL injection vulnerability in Pivotal Spring Data JPA before 1.9.6 (Gosling SR6) and 1.10.x before 1.10.4 (Hopper SR4), when used with a repository that defines a String query using the @Query annotation, allows attackers to execute arbitrary JPQL commands via a sort instance with a function call.
CVE-2016-4999 Critical 2016-08-05 Protected by Waratek No public exploit SQL injection vulnerability in the getStringParameterSQL method in main/java/org/dashbuilder/dataprovider/sql/dialect/DefaultDialect.java in Dashbuilder before 0.6.0.Beta1 allows remote attackers to execute arbitrary SQL commands via a data set lookup filter in the (1) Data Set Authoring or (2) Displayer editor UI.
CVE-2016-2174 High 2016-06-13 Protected by Waratek No public exploit SQL injection vulnerability in the policy admin tool in Apache Ranger before 0.5.3 allows remote authenticated administrators to execute arbitrary SQL commands via the eventTime parameter to service/plugins/policies/eventTime.
CVE-2016-0710 High 2016-04-11 Protected by Waratek Working exploit published Multiple SQL injection vulnerabilities in the User Manager service in Apache Jetspeed before 2.3.1 allow remote attackers to execute arbitrary SQL commands via the (1) role or (2) user parameter to services/usermanager/users/.
CVE-2015-4846 Low 2015-10-21 Protected by Waratek No public exploit Unspecified vulnerability in the Oracle Applications Manager component in Oracle E-Business Suite 11.5.10.2, 12.0.6, 12.1.3, 12.2.3, and 12.2.4 allows remote authenticated users to affect confidentiality and integrity via vectors related to SQL Extensions. NOTE: the previous information is from the October 2015 CPU. Oracle has not commented on third-party claims that this issue is a SQL injection vulnerability, which allows remote authenticated users to execute arbitrary SQL commands via a request involving the afamexts.sql SQL extension.
CVE-2013-4882 Medium 2013-07-22 Protected by Waratek Working exploit published Multiple SQL injection vulnerabilities in McAfee ePolicy Orchestrator 4.6.6 and earlier, and the ePolicy Orchestrator (ePO) extension for McAfee Agent (MA) 4.5 and 4.6, allow remote authenticated users to execute arbitrary SQL commands via the uid parameter to (1) core/showRegisteredTypeDetails.do and (2) EPOAGENTMETA/DisplayMSAPropsDetail.do, a different vulnerability than CVE-2013-0140.
CVE-2013-0140 High 2013-05-01 Protected by Waratek Working exploit published SQL injection vulnerability in the Agent-Handler component in McAfee ePolicy Orchestrator (ePO) before 4.5.7 and 4.6.x before 4.6.6 allows remote attackers to execute arbitrary SQL commands via a crafted request over the Agent-Server communication channel.
CVE-2012-1618 High 2012-10-06 Protected by Waratek No public exploit Interaction error in the PostgreSQL JDBC driver before 8.2, when used with a PostgreSQL server with the "standard_conforming_strings" option enabled, such as the default configuration of PostgreSQL 9.1, does not properly escape unspecified JDBC statement parameters, which allows remote attackers to perform SQL injection attacks. NOTE: as of 20120330, it was claimed that the upstream developer planned to dispute this issue, but an official dispute has not been posted as of 20121005.
CVE-2010-3594 Medium 2011-01-19 Protected by Waratek No public exploit Unspecified vulnerability in the Real User Experience Insight component in Oracle Enterprise Manager Grid Control 6.0 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Processing. NOTE: the previous information was obtained from the January 2011 CPU. Oracle has not commented on claims from a reliable third party coordinator that this is SQL injection in rsynclogdird involving improper escaping of UTF-8 characters while processing log files.
CVE-2007-5766 High 2007-11-08 Protected by Waratek No public exploit SQL injection vulnerability in okxLOV.jsp in Oracle E-Business Suite 11 and 12 allows remote attackers to execute arbitrary SQL commands via unknown vectors. NOTE: this is probably the same issue as CVE-2007-5527 or CVE-2007-5528, but there are insufficient details to be sure.
CVE-2006-7217 Medium 2007-07-05 Protected by Waratek No public exploit Apache Derby before 10.2.1.6 does not determine schema privilege requirements during the DropSchemaNode bind phase, which allows remote authenticated users to execute arbitrary drop schema statements in SQL authorization mode.
CVE-2006-1037 High 2006-03-07 Protected by Waratek No public exploit SQL injection vulnerability in the Oracle Diagnostics module 2.2 and earlier allows remote attackers to execute arbitrary SQL commands via unknown attack vectors.
CVE-2004-0543 High 2004-08-06 Protected by Waratek No public exploit Multiple SQL injection vulnerabilities in Oracle Applications 11.0 and Oracle E-Business Suite 11.5.1 through 11.5.8 allow remote attackers to execute arbitrary SQL procedures and queries.
CVE-2002-1631 High 2002-12-31 Protected by Waratek No public exploit SQL injection vulnerability in the query.xsql sample page in Oracle 9i Application Server (9iAS) allows remote attackers to execute arbitrary code via the sql parameter.