Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 2

Export CSV
CVE-2020-25638

hibernate-core: SQL injection vulnerability when both hibernate.use_sql_comments and JPQL String literals are used

A flaw was found in hibernate-core in versions prior to and including 5.4.23.Final. A SQL injection in the implementation of the JPA Criteria API can permit unsanitized literals when a literal is used in the SQL comments of the query. This flaw could allow an attacker to access unauthorized information or possibly conduct further attacks. The highest threat from this vulnerability is to data confidentiality and integrity.

CVSS 3.1 · 7.4 High EPSS 2.9% KEV · Not listed
Vendors
Debian Hibernate Oracle and 2 more
Products
Debian Linux Hibernate Orm Communications Cloud Native Core Console and 12 more
CVE-2019-14900

hibernate: SQL injection issue in Hibernate ORM

A flaw was found in Hibernate ORM in versions before 5.3.18, 5.4.18 and 5.5.0.Beta1. A SQL injection in the implementation of the JPA Criteria API can permit unsanitized literals when a literal is used in the SELECT or GROUP BY parts of the query. This flaw could allow an attacker to access unauthorized information or possibly conduct further attacks.

CVSS 3.1 · 6.5 Medium EPSS 2.1% KEV · Not listed
Vendors
Hibernate Quarkus Redhat
Products
Hibernate Orm Quarkus Build Of Quarkus and 14 more