p PatchFirst

PatchFirst · Vulnerabilidades recientes

Vulnerabilidades de illuminate/database

Vulnerabilidades publicadas para illuminate/database en los últimos 30 días: 0. Incluidas en el catálogo KEV: 0.

RSS ↗ JSON ↗
Filtrar vulnerabilidades
Borrar filtros

Vulnerabilidades: 5

  1. GHSA-cc2w-ghc5-m5qr

    Sin evaluarCorrección disponible

    Laravel Risk of mass-assignment vulnerabilities

    Laravel 4.1.29 improves the column quoting for all database drivers. This protects your application from some mass assignment vulnerabilities when not using the fillable property on models. If you are using the fillable property on your models to protect against mass assignment, your application is not vulnerable. However, if you are using guarded and are passing a user controlled array into an "update" or "save" type function, you should upgrade to 4.1.29 immediately as your application may be at risk of mass assignment.

    illuminate/databasePHP
    • Actualiza a 4.1.29
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  2. GHSA-4mg9-vhxq-vm7j

    Sin evaluarCorrección disponible

    SQL Server LIMIT / OFFSET SQL Injection in laravel/framework and illuminate/database

    ### Impact Those using SQL Server with Laravel and allowing user input to be passed directly to the `limit` and `offset` functions are vulnerable to SQL injection. Other database drivers such as MySQL and Postgres are not affected by this vulnerability. ### Patches This problem has been patched on Laravel versions 6.20.26, 7.30.5, and 8.40.0. ### Workarounds You may workaround this vulnerability by ensuring that only integers are passed to the `limit` and `offset` functions, as well as the `skip` and `take` functions.

    illuminate/database illuminate/databasePHP
    • Actualiza a 6.20.26
    • Actualiza a 8.40.0
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  3. GHSA-x7p5-p2c9-phvg

    Alta · CVSS 7.2Corrección disponible

    Unexpected database bindings

    This is a follow-up to the previous security advisory (GHSA-3p32-j457-pg5x) which addresses a few additional edge cases. If a request is crafted where a field that is normally a non-array value is an array, and that input is not validated or cast to its expected type before being passed to the query builder, an unexpected number of query bindings can be added to the query. In some situations, this will simply lead to no results being returned by the query builder; however, it is possible certain queries could be affected in a way that causes the query to return unexpected results.

    illuminate/database illuminate/database illuminate/databasePHP
    • Actualiza a 6.20.14
    • Actualiza a 7.30.4
    • Actualiza a 8.24.0
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  4. CVE-2021-21263

    Alta · CVSS 7.2EPSS 1,62%Corrección disponible

    Query Binding Exploitation in Laravel

    Laravel is a web application framework. Versions of Laravel before 6.20.11, 7.30.2 and 8.22.1 contain a query binding exploitation. This same exploit applies to the illuminate/database package which is used by Laravel. If a request is crafted where a field that is normally a non-array value is an array, and that input is not validated or cast to its expected type before being passed to the query builder, an unexpected number of query bindings can be added to the query. In some situations, this will simply lead to no results being returned by the query builder; however, it is possible certain queries could be affected in a way that causes the

    illuminate/database illuminate/database illuminate/databasePHP
    • Actualiza a 6.20.12
    • Actualiza a 7.30.3
    • Actualiza a 8.22.1
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

Comprueba tu servidor

Compara tu pila y las versiones instaladas con las bases actuales de vulnerabilidades.

Comprueba tu servidor →