Vulnerabilities > Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

DATE CVE VULNERABILITY TITLE RISK
2016-06-07 CVE-2015-7695 SQL Injection vulnerability in multiple products
The PDO adapters in Zend Framework before 1.12.16 do not filer null bytes in SQL statements, which allows remote attackers to execute arbitrary SQL commands via a crafted query.
network
low complexity
zend debian CWE-89
critical
 9.8
9.8
2016-05-12 CVE-2016-1393 SQL Injection vulnerability in Cisco Cloud Network Automation Provisioner 1.0/1.1
SQL injection vulnerability in Cisco Cloud Network Automation Provisioner (CNAP) 1.0 and 1.1 allows remote authenticated users to execute arbitrary SQL commands via a crafted URL, aka Bug ID CSCuy72175.
network
low complexity
cisco CWE-89
7.1
7.1
2016-05-09 CVE-2016-4350 SQL Injection vulnerability in Solarwinds Storage Resource Monitor 6.2.1
Multiple SQL injection vulnerabilities in the Web Services web server in SolarWinds Storage Resource Monitor (SRM) Profiler (formerly Storage Manager (STM)) before 6.2.3 allow remote attackers to execute arbitrary SQL commands via the (1) ScriptSchedule parameter in the ScriptServlet servlet; the (2) winEventId or (3) winEventLog parameter in the WindowsEventLogsServlet servlet; the (4) processOS parameter in the ProcessesServlet servlet; the (5) group, (6) groupName, or (7) clientName parameter in the BackupExceptionsServlet servlet; the (8) valDB or (9) valFS parameter in the BackupAssociationServlet servlet; the (10) orderBy or (11) orderDir parameter in the HostStorageServlet servlet; the (12) fileName, (13) sortField, or (14) sortDirection parameter in the DuplicateFilesServlet servlet; the (15) orderFld or (16) orderDir parameter in the QuantumMonitorServlet servlet; the (17) exitCode parameter in the NbuErrorMessageServlet servlet; the (18) udfName, (19) displayName, (20) udfDescription, (21) udfDataValue, (22) udfSectionName, or (23) udfId parameter in the UserDefinedFieldConfigServlet servlet; the (24) sortField or (25) sortDirection parameter in the XiotechMonitorServlet servlet; the (26) sortField or (27) sortDirection parameter in the BexDriveUsageSummaryServlet servlet; the (28) state parameter in the ScriptServlet servlet; the (29) assignedNames parameter in the FileActionAssignmentServlet servlet; the (30) winEventSource parameter in the WindowsEventLogsServlet servlet; or the (31) name, (32) ipOne, (33) ipTwo, or (34) ipThree parameter in the XiotechMonitorServlet servlet.
network
low complexity
solarwinds CWE-89
critical
 9.8
9.8
2016-05-07 CVE-2016-2351 SQL Injection vulnerability in Accellion File Transfer Appliance 80540/911200/911210
SQL injection vulnerability in home/seos/courier/security_key2.api on the Accellion File Transfer Appliance (FTA) before FTA_9_12_40 allows remote attackers to execute arbitrary SQL commands via the client_id parameter.
network
low complexity
accellion CWE-89
critical
 9.8
9.8
2016-05-05 CVE-2016-4351 SQL Injection vulnerability in Trendmicro Email Encryption Gateway 5.5
SQL injection vulnerability in the authentication functionality in Trend Micro Email Encryption Gateway (TMEEG) 5.5 before build 1107 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
network
low complexity
trendmicro CWE-89
critical
 9.8
9.8
2016-04-22 CVE-2016-2301 SQL Injection vulnerability in Ecava Integraxor
SQL injection vulnerability in Ecava IntegraXor before 5.0 build 4522 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.
network
low complexity
ecava CWE-89
6.3
6.3
2016-04-22 CVE-2016-2299 SQL Injection vulnerability in Ecava Integraxor
SQL injection vulnerability in Ecava IntegraXor before 5.0 build 4522 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
network
low complexity
ecava CWE-89
7.3
7.3
2016-04-19 CVE-2016-4040 SQL Injection vulnerability in Dotcms
SQL injection vulnerability in the Workflow Screen in dotCMS before 3.3.2 allows remote administrators to execute arbitrary SQL commands via the orderby parameter.
network
low complexity
dotcms CWE-89
7.2
7.2
2016-04-14 CVE-2015-7999 SQL Injection vulnerability in Citrix Command Center 5.1/5.2
Multiple SQL injection vulnerabilities in the Administration Web UI servlets in Citrix Command Center before 5.1 Build 36.7 and 5.2 before Build 44.11 allow remote authenticated users to execute arbitrary SQL commands via unspecified vectors.
network
low complexity
citrix CWE-89
8.1
8.1
2016-04-12 CVE-2016-3172 SQL Injection vulnerability in Cacti
SQL injection vulnerability in tree.php in Cacti 0.8.8g and earlier allows remote authenticated users to execute arbitrary SQL commands via the parent_id parameter in an item_edit action.
network
low complexity
cacti CWE-89
8.8
8.8