p PatchFirst

PatchFirst · Aktuelle Sicherheitslücken

Sicherheitslücken in illuminate/database

In den letzten 30 Tagen veröffentlichte Sicherheitslücken für illuminate/database: 0. Davon im KEV-Katalog: 0.

RSS ↗ JSON ↗
Sicherheitslücken filtern
Filter zurücksetzen

Sicherheitslücken: 5

  1. GHSA-cc2w-ghc5-m5qr

    Nicht bewertetKorrektur verfügbar

    Laravel Risk of mass-assignment vulnerabilities

    Laravel 4.1.29 improves the column quoting for all database drivers. This protects your application from some mass assignment vulnerabilities when not using the fillable property on models. If you are using the fillable property on your models to protect against mass assignment, your application is not vulnerable. However, if you are using guarded and are passing a user controlled array into an "update" or "save" type function, you should upgrade to 4.1.29 immediately as your application may be at risk of mass assignment.

    illuminate/databasePHP
    • Auf 4.1.29 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  2. GHSA-4mg9-vhxq-vm7j

    Nicht bewertetKorrektur verfügbar

    SQL Server LIMIT / OFFSET SQL Injection in laravel/framework and illuminate/database

    ### Impact Those using SQL Server with Laravel and allowing user input to be passed directly to the `limit` and `offset` functions are vulnerable to SQL injection. Other database drivers such as MySQL and Postgres are not affected by this vulnerability. ### Patches This problem has been patched on Laravel versions 6.20.26, 7.30.5, and 8.40.0. ### Workarounds You may workaround this vulnerability by ensuring that only integers are passed to the `limit` and `offset` functions, as well as the `skip` and `take` functions.

    illuminate/database illuminate/databasePHP
    • Auf 6.20.26 aktualisieren
    • Auf 8.40.0 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  3. GHSA-x7p5-p2c9-phvg

    Hoch · CVSS 7.2Korrektur verfügbar

    Unexpected database bindings

    This is a follow-up to the previous security advisory (GHSA-3p32-j457-pg5x) which addresses a few additional edge cases. If a request is crafted where a field that is normally a non-array value is an array, and that input is not validated or cast to its expected type before being passed to the query builder, an unexpected number of query bindings can be added to the query. In some situations, this will simply lead to no results being returned by the query builder; however, it is possible certain queries could be affected in a way that causes the query to return unexpected results.

    illuminate/database illuminate/database illuminate/databasePHP
    • Auf 6.20.14 aktualisieren
    • Auf 7.30.4 aktualisieren
    • Auf 8.24.0 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  4. CVE-2021-21263

    Hoch · CVSS 7.2EPSS 1,62%Korrektur verfügbar

    Query Binding Exploitation in Laravel

    Laravel is a web application framework. Versions of Laravel before 6.20.11, 7.30.2 and 8.22.1 contain a query binding exploitation. This same exploit applies to the illuminate/database package which is used by Laravel. If a request is crafted where a field that is normally a non-array value is an array, and that input is not validated or cast to its expected type before being passed to the query builder, an unexpected number of query bindings can be added to the query. In some situations, this will simply lead to no results being returned by the query builder; however, it is possible certain queries could be affected in a way that causes the

    illuminate/database illuminate/database illuminate/databasePHP
    • Auf 6.20.12 aktualisieren
    • Auf 7.30.3 aktualisieren
    • Auf 8.22.1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

Prüfen Sie Ihren Server

Gleichen Sie Ihren installierten Stack und seine Versionen mit den aktuellen Sicherheitsmeldungen ab.

Prüfen Sie Ihren Server →