Vulnerabilities

TI-2019-05082 CVE-2019-7164 · GHSA-887w-45rq-vxgf

SQLAlchemy through 1.2.17 and 1.3.x through 1.3.0b2 allows SQL Injection via the order_by parameter.

MEDIUM 48

SQLAlchemy through 1.2.17 and 1.3.x through 1.3.0b2 allows SQL Injection via the order_by parameter.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.03496 Published 2019-02-20 Partial fix · 1.3.0b3 CWE-89

TI-2019-05329 CVE-2019-7548 · GHSA-38fc-9xqv-7f7q

SQLAlchemy 1.2.17 has SQL Injection when the group_by parameter can be controlled.

LOW 38

SQLAlchemy 1.2.17 has SQL Injection when the group_by parameter can be controlled.

CVSS 3.1HIGH 7.8 Local No auth User interaction EPSS 0.01777 Published 2019-02-06 Partial fix · 1.2.19 CWE-89

TI-2012-00742 CVE-2012-0805 · GHSA-hfg2-wf6j-x53p

Multiple SQL injection vulnerabilities in SQLAlchemy before 0.7.0b4, as used in Keystone…

LOW 38

Multiple SQL injection vulnerabilities in SQLAlchemy before 0.7.0b4, as used in Keystone, allow remote attackers to execute arbitrary SQL commands via the (1) limit or (2) offset keyword to the select function, or unspec…

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.0283 Published 2012-06-05 Fixed in 0.7.0b4 CWE-89

Vulnerabilities

Filters

SQLAlchemy through 1.2.17 and 1.3.x through 1.3.0b2 allows SQL Injection via the order_by parameter.

SQLAlchemy 1.2.17 has SQL Injection when the group_by parameter can be controlled.

Multiple SQL injection vulnerabilities in SQLAlchemy before 0.7.0b4, as used in Keystone…