CVE-2012-0805
Last modified
CVE-2012-0805 is a vulnerability of currently unknown severity. Multiple SQL injection vulnerabilities in SQLAlchemy before 0.7.0b4, as used in Keystone, allow remote attackers to execute arbitrary SQL commands via the (1) limit or (2) offset keyword to the select function, or unspecified vectors to the (3) select.limit or (4) select.offset function.. EPSS estimates a 2.86% chance of exploitation in the next 30 days.
Description
Multiple SQL injection vulnerabilities in SQLAlchemy before 0.7.0b4, as used in Keystone, allow remote attackers to execute arbitrary SQL commands via the (1) limit or (2) offset keyword to the select function, or unspecified vectors to the (3) select.limit or (4) select.offset function.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions | Update |
|---|---|---|---|
| Sqlalchemy | Sqlalchemy | <= 0.7.0 | B3 |
| Sqlalchemy | Sqlalchemy | 0.6.0 | — |
| Sqlalchemy | Sqlalchemy | 0.6.1 | — |
| Sqlalchemy | Sqlalchemy | 0.6.2 | — |
| Sqlalchemy | Sqlalchemy | 0.6.3 | — |
| Sqlalchemy | Sqlalchemy | 0.6.4 | — |
| Sqlalchemy | Sqlalchemy | 0.6.5 | — |
| Sqlalchemy | Sqlalchemy | 0.6.6 | — |
| Sqlalchemy | Sqlalchemy | 0.6.7 | — |
| Sqlalchemy | Sqlalchemy | 0.7.0 | B1 |
References
- http://secunia.com/advisories/48327Vendor Advisory
- http://secunia.com/advisories/48328Vendor Advisory
- http://secunia.com/advisories/48771Vendor Advisory
- http://www.sqlalchemy.org/trac/changeset/852b6a1a87e7/Exploit, Patch
- http://secunia.com/advisories/48327Vendor Advisory
- http://secunia.com/advisories/48328Vendor Advisory
- http://secunia.com/advisories/48771Vendor Advisory
- http://www.sqlalchemy.org/trac/changeset/852b6a1a87e7/Exploit, Patch
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2012-0805?
How severe is CVE-2012-0805?
How do I fix CVE-2012-0805?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2012
- CVE-2012-0799Moodle 2.0.x before 2.0.7 and 2.1.x before 2.1.4, when an an…
- CVE-2012-0800The form-autocompletion functionality in Moodle 2.0.x before…
- CVE-2012-0801lib/formslib.php in Moodle 2.1.x before 2.1.4 and 2.2.x befo…
- CVE-2012-0802Multiple buffer overflows in Spamdyke before 4.3.0 might all…
- CVE-2012-0803The WS-SP UsernameToken policy in Apache CXF 2.4.5 and 2.5.1…
- CVE-2012-0804Heap-based buffer overflow in the proxy_connect function in …
- CVE-2012-0806Buffer overflow in Bip 0.8.8 and earlier might allow remote …
- CVE-2012-0807Stack-based buffer overflow in the suhosin_encrypt_single_co…
- CVE-2012-0808as31 2.3.1-4 does not seed the random number generator and g…
- CVE-2012-0809Format string vulnerability in the sudo_debug function in Su…
- CVE-2012-0810The int3 handler in the Linux kernel before 3.3 relies on a …5.5
- CVE-2012-0811Multiple SQL injection vulnerabilities in Postfix Admin (aka…
Are you affected by CVE-2012-0805?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST