h2: Remote Code Execution in Console

A flaw was found in h2. The org.h2.util.JdbcUtils.getConnection method of the H2 database takes as parameters the class name of the driver and URL of the database. This flaw allows an attacker to use this URL to send another server’s code, causing remote code execution. This issue is exploited...

Microsoft ODBC Driver 安全漏洞

Microsoft ODBC Driver is a driver from Microsoft. It allows applications to access data in a database management system DBMS using SQL as the standard for accessing data. A security vulnerability exists in the Microsoft Windows ODBC Driver. The following products and editions are affected: Window...

PT-2022-5738 · Microsoft · Sql Server +2

Name of the Vulnerable Software and Affected Versions: Microsoft WDAC OLE DB provider for SQL Server affected versions not specified Description: The issue is caused by insufficient input validation in the OLE DB driver for SQL Server on the Windows operating system. This allows a remote attacker...

DEBIAN-CVE-2022-31197

PostgreSQL JDBC Driver PgJDBC for short allows Java programs to connect to a PostgreSQL database using standard, database independent Java code. The PGJDBC implementation of the java.sql.ResultRow.refreshRow method is not performing escaping of column names so a malicious column name that contain...

PT-2022-4408 · Apache · Apache Calcite Avatica Jdbc Driver

Name of the Vulnerable Software and Affected Versions: Apache Calcite Avatica JDBC driver versions prior to 1.22.0 Description: The issue is related to the creation of HTTP client instances based on class names provided via the httpclient impl connection property. The driver does not verify if th...

[SECURITY] Fedora 35 Update: golang-github-uber-athenadriver-1.1.12-5.fc35

A fully-featured AWS Athena database driver...

Fedora: Security Advisory for golang-github-uber-athenadriver (FEDORA-2022-fae3ecee19)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

CVE-2022-29971

An argument injection vulnerability in the browser-based authentication component of the Magnitude Simba Amazon Athena ODBC Driver 1.1.1 through 1.1.x before 1.1.17 may allow a local user to execute arbitrary code...

Databasir 输入验证错误漏洞

Databasir is a team-oriented document management platform for relational database models. A security vulnerability exists in Databasir 1.01 that originates from the JDBC driver being unauthenticated before use leading to code execution by any basic user with access to the system...

Databasir 代码问题漏洞

Databasir is a team-oriented relational database model document management platform. A security vulnerability exists in Databasir 1.01. The vulnerability stems from the fact that during the JDBC driver download validation process, the corresponding JDBC driver download address is downloaded first...

Vulnerability fixed in PostgreSQL JDBC Driver

A vulnerability has been fixed in the PostgreSQL JDBC Driver. The vulnerability allows an authenticated remote malicious person to able to execute arbitrary code. The developers of the PostgreSQL JDBC Driver have released updates released updates to fix the vulnerability. More information can be...

PT-2021-3510

Name of the Vulnerable Software and Affected Versions PHP versions 7.3.x through 7.3.28 PHP versions 7.4.x through 7.4.20 PHP versions 8.0.x through 8.0.7 Description The issue is related to insufficient input validation in the Firebird PDO driver extension. A malicious database server could caus...

GHSA-4MG9-VHXQ-VM7J SQL Server LIMIT / OFFSET SQL Injection in laravel/framework and illuminate/database

Impact Those using SQL Server with Laravel and allowing user input to be passed directly to the limit and offset functions are vulnerable to SQL injection. Other database drivers such as MySQL and Postgres are not affected by this vulnerability. Patches This problem has been patched on Laravel...

Daniel Fahlke magento-lts SQL注入漏洞

Magento lts is a long term support alternative to Magento Community Edition CE. A SQL injection vulnerability exists in Magento-lts. The vulnerability stems from insufficient handling of user-supplied data in the "lib/Varien/Db/Adapter/Pdo/Mysql.php" script when processing field names. An attacke...

UBUNTU-CVE-2014-10402

An issue was discovered in the DBI module through 1.643 for Perl. DBD::File drivers can open files from folders other than those specifically passed via the fdir attribute in the data source name DSN. NOTE: this issue exists because of an incomplete fix for CVE-2014-10401...

UBUNTU-CVE-2014-10401

An issue was discovered in the DBI module before 1.632 for Perl. DBD::File drivers can open files from folders other than those specifically passed via the fdir attribute...

Debian: Security Advisory (DLA-2245-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

The vulnerability of the Connector/J driver for MySQL Connectors in the MySQL database management system allows a hacker to cause a service failure.

The vulnerability of the Connector/J driver for MySQL Connectors in the MySQL database management system is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker to cause service interruptions using the MySQL Protocol...

The vulnerability of the ConfigXmlUtils function in the JDBC driver library allows a attacker to cause a service failure.

The vulnerability of the ConfigXmlUtils function in the JDBC driver library c3p0 is related to errors in processing XML entities. Exploiting this vulnerability can allow a malicious actor to cause service failures remotely...

ImpressCMS 1.3.11 - Why you should not trust PHP_SELF

We scanned the at the time current version 1.3.11 of ImpressCMS and found an unauthorized SQL Injection vulnerability. The exploit affects installations that use PDO as a database driver. The issue was fixed in version 1.4.0, though the patch does not follow best practices and might not be...