Minhgalaxy

توجد ثغرة حقن SQL تتطلب مصادقة في واجهة برمجة تطبيقات تقارير ADAudit Plus (Reports API). حقن SQL هو تقنية يتم من خلالها إدخال بيانات SQL خبيثة في حقول الإدخال لتنفيذها، مما قد يسمح بالوصول غير المصرح به إلى قاعدة البيانات أو التلاعب بها.

Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting. An attacker can inject arbitrary web scripts through the IPN endpoint using the `rel` and `option` parameters. Because the endpoint lacks authentication, nonce validation, or signature verification, malicious payloads are stored and subsequently executed when an administrator views the settlement error log.

تتعلق المشكلة بثغرة أمنية في قناة جانبية للتوقيت في تنفيذ P-384 عند استخدامه مع ECDSA في بنية PPC. بالإضافة إلى ذلك، هناك نقص في التحقق من وجود مؤشر فارغ قبل الوصول إلى `handshake func` في `ssl lib.c`. وقد يؤدي ذلك إلى مشاكل أمنية. وهناك أيضًا مشكلة تتعلق بتعطيل EMS في إعدادات OpenSSL، مما يمنع sshd من التشغيل. **التوصيات** في الوقت الحالي، لا توجد معلومات عن إصدار أحدث يحتوي على تصحيح لهذه الثغرة الأمنية.

تتعلق المشكلة بحقن SQL مصادق عليه في التقرير المجمع لأحداث تسجيل الدخول.

Name of the Vulnerable Software and Affected Versions: Zohocorp ManageEngine Exchange Reporter Plus versions before 5715 Description: The issue is related to SQL Injection in the reports module of the software. This allows for potential exploitation. No information is provided about the estimated number of potentially affected devices worldwide or real-world incidents where this issue was exploited. Recommendations: For versions before 5715, update to a version 5715 or later to resolve the SQL Injection issue in the reports module. As a temporary workaround, consider restricting access to the reports module until a patch is available.

The issue concerns an authenticated SQL injection vulnerability in the file summary option. This vulnerability affects Zohocorp ManageEngine ADAudit Plus.

The issue is related to an authenticated SQL injection in the dashboard of ADAudit Plus. This vulnerability is distinct from another issue affecting the same dashboard.

The issue is related to an authenticated SQL injection in the dashboard of Zohocorp ManageEngine ADAudit Plus. This vulnerability is distinct from another issue affecting the same dashboard.

The issue concerns an authenticated SQL injection vulnerability in the alerts module. This vulnerability affects versions of Zohocorp ManageEngine ADAudit Plus below 8000.

The issue concerns an authenticated SQL injection vulnerability in the account lockout report of Zohocorp ManageEngine ADAudit Plus. This vulnerability allows for malicious SQL code execution, potentially leading to unauthorized access or data manipulation.

The issue concerns an authenticated SQL injection vulnerability in the aggregate reports option. This vulnerability can be exploited by authenticated users, potentially leading to unauthorized access or manipulation of data.

The issue concerns an authenticated SQL injection in the reports module.

The issue concerns an authenticated SQL injection vulnerability in the extranet lockouts report option. This vulnerability can be exploited by authenticated users, potentially leading to unauthorized access or data manipulation. No information is provided about the estimated number of potentially affected devices worldwide or real-world incidents where this issue was exploited.

The issue is related to an authenticated SQL Injection vulnerability in user session recording.

The issue concerns an authenticated SQL Injection vulnerability in the aggregate reports' search option. This allows attackers to inject malicious SQL code, potentially leading to unauthorized access or data manipulation.

The issue is related to the lack of protection against SQL query structure attacks in the reports module of ManageEngine Exchange Reporter Plus. This can allow a remote attacker to execute arbitrary SQL queries to the database. The exploitation of this issue is possible through authenticated SQL injection in the reports module.

The issue allows SQL Injection while getting aggregate report data.

The issue allows SQL injection in the dashboard graph feature. This could potentially lead to remote attacks and data compromise.

The issue allows SQL injection while adding file shares. There is no information provided about the estimated number of potentially affected devices worldwide or real-world incidents where this issue was exploited.

The issue allows SQL injection in the aggregate reports search option. This could potentially be exploited to extract or modify sensitive data.