WaratekVRT Sign in
Reset
More filters (2)
Columns
ARMR rules: SQL injection✕Published to 2022-01-31✕
Overview 9 matches · 0 exploited · 0 CISA KEV · 1 public PoC · 0 EPSS ≥ 0.5
9matches 0exploited0.0% 0CISA KEV0.0% 1public PoC11.1% 0EPSS ≥ 0.50.0%
Protected by Waratek 9 100.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 0 0.0%
Critical 0 0.0% High 0 0.0% Medium 9 100.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 9 100.0% partly blocked 0 0.0% not blocked 0 0.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 0 0.0% Working exploit published 1 11.1% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 8 88.9%
split by peak 1 / year
Protected by Waratek: 9 Medium: 9 blocked by ARMR today: 9 No public exploit: 8Working exploit published: 1
20071 Protected by Waratek1 Medium1 blocked by ARMR today1 No public exploit1 20080 20090 20100 20111 Protected by Waratek1 Medium1 blocked by ARMR today1 No public exploit1 20120 20131 Protected by Waratek1 Medium1 blocked by ARMR today1 Working exploit published1 20140 20150 20161 Protected by Waratek1 Medium1 blocked by ARMR today1 No public exploit1 20171 Protected by Waratek1 Medium1 blocked by ARMR today1 No public exploit1 20180 20191 Protected by Waratek1 Medium1 blocked by ARMR today1 No public exploit1 20201 Protected by Waratek1 Medium1 blocked by ARMR today1 No public exploit1 20211 Protected by Waratek1 Medium1 blocked by ARMR today1 No public exploit1 20221 Protected by Waratek1 Medium1 blocked by ARMR today1 No public exploit1
20082010201220142016201820202022
9 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2021-36774 Medium 2022-01-06 Protected by Waratek No public exploit Apache Kylin allows users to read data from other database systems using JDBC. The MySQL JDBC driver supports certain properties, which, if left unmitigated, can allow an attacker to execute arbitrary code from a hacker-controlled malicious MySQL server within Kylin server processes. This issue affects Apache Kylin 2 version 2.6.6 and prior versions; Apache Kylin 3 version 3.1.2 and prior versions.
CVE-2020-5428 Medium 2021-01-27 Protected by Waratek No public exploit In applications using Spring Cloud Task 2.2.4.RELEASE and below, may be vulnerable to SQL injection when exercising certain lookup queries in the TaskExplorer.
CVE-2019-14900 Medium 2020-07-06 Protected by Waratek No public exploit A flaw was found in Hibernate ORM in versions before 5.3.18, 5.4.18 and 5.5.0.Beta1. A SQL injection in the implementation of the JPA Criteria API can permit unsanitized literals when a literal is used in the SELECT or GROUP BY parts of the query. This flaw could allow an attacker to access unauthorized information or possibly conduct further attacks.
CVE-2019-3797 Medium 2019-05-06 Protected by Waratek No public exploit This affects Spring Data JPA in versions up to and including 2.1.5, 2.0.13 and 1.11.19. Derived queries using any of the predicates ‘startingWith’, ‘endingWith’ or ‘containing’ could return more results than anticipated when a maliciously crafted query parameter value is supplied. Also, LIKE expressions in manually defined queries could return unexpected results if the parameter values bound did not have escaped reserved characters properly.
CVE-2017-4974 Medium 2017-06-13 Protected by Waratek No public exploit An issue was discovered in Cloud Foundry Foundation cf-release versions prior to v258; UAA release 2.x versions prior to v2.7.4.15, 3.6.x versions prior to v3.6.9, 3.9.x versions prior to v3.9.11, and other versions prior to v3.16.0; and UAA bosh release (uaa-release) 13.x versions prior to v13.13, 24.x versions prior to v24.8, and other versions prior to v30.1. An authorized user can use a blind SQL injection attack to query the contents of the UAA database, aka "Blind SQL Injection with privileged UAA endpoints."
CVE-2016-6652 Medium 2016-10-05 Protected by Waratek No public exploit SQL injection vulnerability in Pivotal Spring Data JPA before 1.9.6 (Gosling SR6) and 1.10.x before 1.10.4 (Hopper SR4), when used with a repository that defines a String query using the @Query annotation, allows attackers to execute arbitrary JPQL commands via a sort instance with a function call.
CVE-2013-4882 Medium 2013-07-22 Protected by Waratek Working exploit published Multiple SQL injection vulnerabilities in McAfee ePolicy Orchestrator 4.6.6 and earlier, and the ePolicy Orchestrator (ePO) extension for McAfee Agent (MA) 4.5 and 4.6, allow remote authenticated users to execute arbitrary SQL commands via the uid parameter to (1) core/showRegisteredTypeDetails.do and (2) EPOAGENTMETA/DisplayMSAPropsDetail.do, a different vulnerability than CVE-2013-0140.
CVE-2010-3594 Medium 2011-01-19 Protected by Waratek No public exploit Unspecified vulnerability in the Real User Experience Insight component in Oracle Enterprise Manager Grid Control 6.0 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Processing. NOTE: the previous information was obtained from the January 2011 CPU. Oracle has not commented on claims from a reliable third party coordinator that this is SQL injection in rsynclogdird involving improper escaping of UTF-8 characters while processing log files.
CVE-2006-7217 Medium 2007-07-05 Protected by Waratek No public exploit Apache Derby before 10.2.1.6 does not determine schema privilege requirements during the DropSchemaNode bind phase, which allows remote authenticated users to execute arbitrary drop schema statements in SQL authorization mode.