fkie_cve-2014-2949

SQL injection vulnerability in the web service in F5 ARX Data Manager 3.0.0 through 3.1.0 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.

GHSA-ggjq-724x-pgcp

SQL injection vulnerability in the web service in F5 ARX Data Manager 3.0.0 through 3.1.0 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.

VAR-201406-0322

SQL injection vulnerability in the web service in F5 ARX Data Manager 3.0.0 through 3.1.0 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors. CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') http://cwe.mitre.org/data/definitions/89.htmlDepending on the user who can log in to the product, any database on the database referenced by the product SQL The command may be executed. Authentication is not required to exploit this vulnerability. The specific flaw exists within the discoverFilerBasicInfo.jsft page. An attacker is able to inject SQL through the filerName field in this page, and use that to gain full administrator credentials for Data Manager. An attacker can exploit this issue by manipulating the SQL query logic to carry out unauthorized actions on the underlying database. The solution supports data migration, storage tiering, and storage capacity balancing

Most recent entries from all

fkie_cve-2014-2949

GHSA-ggjq-724x-pgcp

gsd-2014-2949

VAR-201406-0322