1025 vulnerabilidades · Database Orden: CVSS EPSS Año ID
CVE-2022-21372
MySQL Server Database
2.7
LOW
EPSS
0.1%
2022 1 PoC

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Encryption). Supported versions that are affected are 8.0.27 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of MySQL Server. CVSS 3.1 Base Score 2.7 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L).

Scanner Automatizado
Sin template local disponible
CVE-2022-21423
MySQL Server Database
2.7
LOW
EPSS
0.2%
2022 1 PoC

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.28 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of MySQL Server. CVSS 3.1 Base Score 2.7 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L).

Scanner Automatizado
Sin template local disponible
CVE-2022-21247
Database - Enterprise Edition Database
2.7
LOW
EPSS
0.2%
2022 1 PoC

Vulnerability in the Core RDBMS component of Oracle Database Server. Supported versions that are affected are 12.2.0.1 and 19c. Easily exploitable vulnerability allows high privileged attacker having Create Session, Execute Catalog Role privilege with network access via Oracle Net to compromise Core RDBMS. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Core RDBMS accessible data. CVSS 3.1 Base Score 2.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N).

Scanner Automatizado
Sin template local disponible
CVE-2022-21249
MySQL Server Database
2.7
LOW
EPSS
0.2%
2022 1 PoC

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DDL). Supported versions that are affected are 8.0.27 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of MySQL Server. CVSS 3.1 Base Score 2.7 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L).

Scanner Automatizado
Sin template local disponible
CVE-2022-39409
Transportation Management Web Database
2.7
LOW
EPSS
0.3%
2022 1 PoC

Vulnerability in the Oracle Transportation Management product of Oracle Supply Chain (component: Business Process Automation). Supported versions that are affected are 6.4.3 and 6.5.1. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Transportation Management. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Transportation Management. CVSS 3.1 Base Score 2.7 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L).

Scanner Automatizado
Sin template local disponible
CVE-2022-46498
Software Genérico Web Database
2.7
LOW
EPSS
0.1%
2022 1 PoC

Hospital Management System 1.0 was discovered to contain a SQL injection vulnerability via the doc_number parameter at his_admin_view_single_employee.php.

Scanner Automatizado
Sin template local disponible
CVE-2022-21432
Text Database
2.7
LOW
EPSS
0.1%
2022 1 PoC

Vulnerability in the Oracle Database - Enterprise Edition RDBMS Security component of Oracle Database Server. Supported versions that are affected are 12.1.0.2, 19c and 21c. Easily exploitable vulnerability allows high privileged attacker having DBA role privilege with network access via Oracle Net to compromise Oracle Database - Enterprise Edition RDBMS Security. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Database - Enterprise Edition RDBMS Security. CVSS 3.1 Base Score 2.7 (Availability impacts). CV

Scanner Automatizado
Sin template local disponible
CVE-2022-21535
MySQL Server Database
2.5
LOW
EPSS
0.2%
2022 1 PoC

Vulnerability in the MySQL Shell product of Oracle MySQL (component: Shell: General/Core Client). Supported versions that are affected are 8.0.28 and prior. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where MySQL Shell executes to compromise MySQL Shell. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of MySQL Shell. CVSS 3.1 Base Score 2.5 (Availability impacts). CVSS Vector: (

Scanner Automatizado
Sin template local disponible
CVE-2022-28080
Software Genérico Database ⚡ nuclei
N/A
UNKNOWN
EPSS
42.0%
2022 3 PoCs

Royal Event Management System v1.0 was discovered to contain a SQL injection vulnerability via the todate parameter.

Scanner Automatizado
nuclei -t CVE-2022-28080.yaml ⎘
CVE-2022-25811
Transposh WordPress Translation Web Database Windows
N/A
UNKNOWN
EPSS
0.8%
2022 CWE-89 1 PoC

The Transposh WordPress Translation WordPress plugin through 1.0.8 does not sanitise and escape the order and orderby parameters before using them in a SQL statement, leading to a SQL injection

Scanner Automatizado
Sin template local disponible
CVE-2022-26633
Software Genérico Web Database
N/A
UNKNOWN
EPSS
0.4%
2022 1 PoC

Simple Student Quarterly Result/Grade System v1.0 was discovered to contain a SQL injection vulnerability via /sqgs/Actions.php.

Scanner Automatizado
Sin template local disponible
CVE-2022-0410
WP Visitor Statistics (Real Time Traffic) Web Database Windows
N/A
UNKNOWN
EPSS
1.2%
2022 CWE-89 1 PoC

The WP Visitor Statistics (Real Time Traffic) WordPress plugin before 5.6 does not sanitise and escape the id parameter before using it in a SQL statement via the refUrlDetails AJAX action, available to any authenticated user, leading to a SQL injection

Scanner Automatizado
Sin template local disponible
CVE-2022-29007
Software Genérico Database ⚡ nuclei
N/A
UNKNOWN
EPSS
92.5%
2022 2 PoCs

Multiple SQL injection vulnerabilities via the username and password parameters in the Admin panel of Dairy Farm Shop Management System v1.0 allows attackers to bypass authentication.

Scanner Automatizado
nuclei -t CVE-2022-29007.yaml ⎘
CVE-2022-0693
Master Elements Web Database Windows ⚡ nuclei
N/A
UNKNOWN
EPSS
68.2%
2022 CWE-89 1 PoC

The Master Elements WordPress plugin through 8.0 does not validate and escape the meta_ids parameter of its remove_post_meta_condition AJAX action (available to both unauthenticated and authenticated users) before using it in a SQL statement, leading to an unauthenticated SQL Injection

Scanner Automatizado
nuclei -t CVE-2022-0693.yaml ⎘
CVE-2022-33171
Software Genérico Database
N/A
UNKNOWN
EPSS
4.6%
2022 1 PoC

The findOne function in TypeORM before 0.3.0 can either be supplied with a string or a FindOneOptions object. When input to the function is a user-controlled parsed JSON object, supplying a crafted FindOneOptions instead of an id string leads to SQL injection. NOTE: the vendor's position is that the user's application is responsible for input validation

Scanner Automatizado
Sin template local disponible
CVE-2022-28006
Software Genérico Web Database
N/A
UNKNOWN
EPSS
0.4%
2022 2 PoCs

Attendance and Payroll System v1.0 was discovered to contain a SQL injection vulnerability via the component \admin\employee_delete.php.

Scanner Automatizado
Sin template local disponible
CVE-2022-32246
SAP BusinessObjects Business Intelligence Platform (Visual Difference Application) Database
N/A
UNKNOWN
EPSS
0.4%
2022 CWE-89 2 PoCs

SAP Busines Objects Business Intelligence Platform (Visual Difference Application) - versions 420, 430, allows an authenticated attacker who has access to BI admin console to send crafted queries and extract data from the SQL backend. On successful exploitation, the attacker can cause limited impact on confidentiality and integrity of the application

Scanner Automatizado
Sin template local disponible
CVE-2022-32081
Software Genérico Database
N/A
UNKNOWN
EPSS
0.1%
2022 1 PoC

MariaDB v10.4 to v10.7 was discovered to contain an use-after-poison in prepare_inplace_add_virtual at /storage/innobase/handler/handler0alter.cc.

Scanner Automatizado
Sin template local disponible
CVE-2022-36640
Software Genérico Database
N/A
UNKNOWN
EPSS
6.8%
2022 3 PoCs

influxData influxDB before v1.8.10 contains no authentication mechanism or controls, allowing unauthenticated attackers to execute arbitrary commands. NOTE: the CVE ID assignment is disputed because the vendor's documentation states "If InfluxDB is being deployed on a publicly accessible endpoint, we strongly recommend authentication be enabled. Otherwise the data will be publicly available to any unauthenticated user. The default settings do NOT enable authentication and authorization.

Scanner Automatizado
Sin template local disponible
CVE-2022-32086
Software Genérico Database
N/A
UNKNOWN
EPSS
0.1%
2022 1 PoC

MariaDB v10.4 to v10.8 was discovered to contain a segmentation fault via the component Item_field::fix_outer_field.

Scanner Automatizado
Sin template local disponible