WaratekVRT Sign in
Reset
More filters (2)
Columns
ARMR rules: SQL injection✕Published to 2023-03-31✕
Overview 19 matches · 1 exploited · 0 CISA KEV · 2 public PoC · 1 EPSS ≥ 0.5
19matches 1exploited5.3% 0CISA KEV0.0% 2public PoC10.5% 1EPSS ≥ 0.55.3%
Protected by Waratek 19 100.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 0 0.0%
Critical 19 100.0% High 0 0.0% Medium 0 0.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 19 100.0% partly blocked 0 0.0% not blocked 0 0.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 1 5.3% Working exploit published 1 5.3% Proof of concept only 1 5.3% Forecast only 0 0.0% No public exploit 16 84.2%
split by peak 8 / year
Protected by Waratek: 19 Critical: 19 blocked by ARMR today: 19 No public exploit: 16Proof of concept only: 1Working exploit published: 1Exploited: 1
20161 Protected by Waratek1 Critical1 blocked by ARMR today1 No public exploit1 20172 Protected by Waratek2 Critical2 blocked by ARMR today2 Working exploit published1 No public exploit1 20181 Protected by Waratek1 Critical1 blocked by ARMR today1 No public exploit1 20191 Protected by Waratek1 Critical1 blocked by ARMR today1 No public exploit1 20204 Protected by Waratek4 Critical4 blocked by ARMR today4 No public exploit4 20210 20228 Protected by Waratek8 Critical8 blocked by ARMR today8 Proof of concept only1 No public exploit7 20232 Protected by Waratek2 Critical2 blocked by ARMR today2 Exploited1 No public exploit1
20162017201820192020202120222023
19 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2023-25158 Critical 2023-02-21 Protected by Waratek Exploited GeoTools is an open source Java library that provides tools for geospatial data. GeoTools includes support for OGC Filter expression language parsing, encoding and execution against a range of datastore. SQL Injection Vulnerabilities have been found when executing OGC Filters with JDBCDataStore implementations. Users are advised to upgrade to either version 27.4 or to 28.2 to resolve this issue. Users unable to upgrade may disable `encode functions` for PostGIS DataStores or enable `prepared statements` for JDBCDataStores as a partial mitigation.
CVE-2023-24163 Critical 2023-01-31 Protected by Waratek No public exploit SQL Inection vulnerability in Dromara hutool before 5.8.21 allows attacker to execute arbitrary code via the aviator template engine.
CVE-2022-42122 Critical 2022-11-15 Protected by Waratek No public exploit A SQL injection vulnerability in the Friendly Url module in Liferay Portal 7.3.7, and Liferay DXP 7.3 fix pack 2 through update 4 allows attackers to execute arbitrary SQL commands via a crafted payload injected into the `title` field of a friendly URL.
CVE-2022-42120 Critical 2022-11-15 Protected by Waratek No public exploit A SQL injection vulnerability in the Fragment module in Liferay Portal 7.3.3 through 7.4.3.16, and Liferay DXP 7.3 before update 4, and 7.4 before update 17 allows attackers to execute arbitrary SQL commands via a PortletPreferences' `namespace` attribute.
CVE-2022-37223 Critical 2022-08-23 Protected by Waratek No public exploit JFinal CMS 5.1.0 is vulnerable to SQL Injection via /jfinal_cms/system/role/list.
CVE-2022-37199 Critical 2022-08-23 Protected by Waratek No public exploit JFinal CMS 5.1.0 is vulnerable to SQL Injection via /jfinal_cms/system/user/list.
CVE-2022-34115 Critical 2022-07-22 Protected by Waratek No public exploit DataEase v1.11.1 was discovered to contain a arbitrary file write vulnerability via the parameter dataSourceId.
CVE-2022-30500 Critical 2022-05-26 Protected by Waratek No public exploit Jfinal cms 5.1.0 is vulnerable to SQL Injection.
CVE-2022-28111 Critical 2022-05-04 Protected by Waratek No public exploit MyBatis PageHelper v1.x.x-v3.7.0 v4.0.0-v5.0.0,v5.1.0-v5.3.0 was discovered to contain a time-blind SQL injection vulnerability via the orderBy parameter.
CVE-2022-23305 Critical 2022-01-18 Protected by Waratek Proof of concept only By design, the JDBCAppender in Log4j 1.2.x accepts an SQL statement as a configuration parameter where the values to be inserted are converters from PatternLayout. The message converter, %m, is likely to always be included. This allows attackers to manipulate the SQL by entering crafted strings into input fields or headers of an application that are logged allowing unintended SQL queries to be executed. Note this issue only affects Log4j 1.x when specifically configured to use the JDBCAppender, which is not the default. Beginning in version 2.0-beta8, the JDBCAppender was re-introduced with proper support for parameterized SQL queries and further customization over the columns written to in logs. Apache Log4j 1.2 reached end of life in August 2015. Users should upgrade to Log4j 2 as it addresses numerous other issues from the previous versions.
CVE-2020-13921 Critical 2020-08-05 Protected by Waratek No public exploit **Resolved** Only when using H2/MySQL/TiDB as Apache SkyWalking storage, there is a SQL injection vulnerability in the wildcard query cases.
CVE-2020-13926 Critical 2020-07-14 Protected by Waratek No public exploit Kylin concatenates and executes a Hive SQL in Hive CLI or beeline when building a new segment; some part of the HQL is from system configurations, while the configuration can be overwritten by certain rest api, which makes SQL injection attack is possible. Users of all previous versions after 2.0 should upgrade to 3.1.0.
CVE-2016-11024 Critical 2020-03-30 Protected by Waratek No public exploit odata4j 0.7.0 allows ExecuteJPQLQueryCommand.java SQL injection. NOTE: this product is apparently discontinued.
CVE-2016-11023 Critical 2020-03-30 Protected by Waratek No public exploit odata4j 0.7.0 allows ExecuteCountQueryCommand.java SQL injection. NOTE: this product is apparently discontinued.
CVE-2019-15563 Critical 2019-08-26 Protected by Waratek No public exploit Observational Health Data Sciences and Informatics (OHDSI) WebAPI before 2.7.2 allows SQL injection in FeatureExtractionService.java.
CVE-2018-1282 Critical 2018-04-05 Protected by Waratek No public exploit This vulnerability in Apache Hive JDBC driver 0.7.1 to 2.3.2 allows carefully crafted arguments to be used to bypass the argument escaping/cleanup that JDBC driver does in PreparedStatement implementation.
CVE-2017-3549 Critical 2017-04-24 Protected by Waratek Working exploit published Vulnerability in the Oracle Scripting component of Oracle E-Business Suite (subcomponent: Scripting Administration). Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5 and 12.2.6. Easily "exploitable" vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Scripting. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Scripting accessible data as well as unauthorized access to critical data or complete access to all Oracle Scripting accessible data. CVSS 3.0 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).
CVE-2016-8027 Critical 2017-03-14 Protected by Waratek No public exploit SQL injection vulnerability in core services in Intel Security McAfee ePolicy Orchestrator (ePO) 5.3.2 and earlier and 5.1.3 and earlier allows attackers to alter a SQL query, which can result in disclosure of information within the database or impersonation of an agent without authentication via a specially crafted HTTP post.
CVE-2016-4999 Critical 2016-08-05 Protected by Waratek No public exploit SQL injection vulnerability in the getStringParameterSQL method in main/java/org/dashbuilder/dataprovider/sql/dialect/DefaultDialect.java in Dashbuilder before 0.6.0.Beta1 allows remote attackers to execute arbitrary SQL commands via a data set lookup filter in the (1) Data Set Authoring or (2) Displayer editor UI.