An unsafe reflection vulnerability has been reported in the Business Data Connectivity service of Microsoft SharePoint Server. This vulnerability is due to insufficient input validation of the parameters sent to the FindFiltered method of an Entity object of a Line-of-Business (LOB) system instance. A remote, authenticated attacker could exploit this vulnerability by sending crafted requests to the target server. Successful exploitation could result in the execution of code in the security context of the server process.

SQL injection is a vulnerability that allows an attacker to alter backend SQL statements by manipulating the user input. An SQL injection occurs when web applications accept user input that is directly placed into a SQL statement and doesn't properly filter out dangerous characters.

A remote attacker could exploit this vulnerabilities by sending a crafted request to the target server. Successfully exploiting this vulnerability could result in arbitrary code execution in the context of the victim's browser.

Threat Encyclopedia

1235461

WEB Microsoft SharePoint Server Business Data Connectivity FindFiltered Unsafe Reflection -3 (CVE-2024-38024)

High

2024/12/04

1058077

WEB SQL injection attempt -1.b

High

2024/12/04

1235078

WEB GitLab abstract_reference_filter Stored Cross-Site Scripting -2 (CVE-2023-6371)

High

2024/12/03

1235077

WEB GitLab abstract_reference_filter Stored Cross-Site Scripting -1 (CVE-2023-6371)

High

2024/12/03