205 matches found
CVE-2024-56428
CVE-2024-56428 Cleartext credentials in local database of the iLabClient Read out the configuration incl. password The iLabClient is used to download the results from the laboratory server. The configuration data are stored locally in the Apache Derby instance iLabClient. The password is stored i...
Nacos <1.4.1 - Authentication Bypass
Nacos before version 1.4.1 is vulnerable to authentication bypass because the ConfigOpsController lets the user perform management operations like querying the database or even wiping it out. While the /data/remove endpoint is properly protected with the @Secured annotation, the /derby endpoint i...
CVE-2024-56429
CVE-2024-56429 Access to the local database of the iLabClient Extract database password The iLabClient uses an Apache Derby database to store the locally required data. To ensure the encryption, a bootPassword is used for the creation, which can be extracted from the source code the extracted cod...
cve-2021-29442-Nacos-Derby-rce-exp
Introduction Nacos Derby command execution vulnerability exploitation script, by default uses User-Agent bypass to exploit the vulnerability Nacos is an open-source platform for service registration, discovery, and configuration management. In its early versions ≤2.4.0-BETA, Nacos integrates Apac...
mirth-connect-security-poc
NextGen Connect 4.5.2 vulnerability PoCs Working proof-of-concept exploits for three network-reachable vulnerabilities in NextGen Connect Mirth Connect 4.5.2. The harnesses run the official container image, create only the channel configuration needed by the finding, execute the attack from a...
Astra Linux – Vulnerability in Derby
A cleverly designed username can bypass LDAP authentication checks. In LDAP-authenticated Derby installations, this could allow an attacker to create unnecessary Derby databases, thereby filling up storage space. In LDAP-authenticated Derby installations, the attacker could also execute malware...
ROOT-APP-MAVEN-CVE-2022-46337 CVE-2022-46337 in io.root.org.apache.derby:derby - Patched by Root
Root has patched CVE-2022-46337 in the io.root.org.apache.derby:derby package for Root:Maven. Multiple fixed versions available...
ROOT-APP-MAVEN-CVE-2018-1313 CVE-2018-1313 in io.root.org.apache.derby:derby - Patched by Root
Root has patched CVE-2018-1313 in the io.root.org.apache.derby:derby package for Root:Maven. Multiple fixed versions available...
Unity Linux 20.1050e / 20.1060e / 20.1070-8ae / 20.1070e Security Update: derby (UTSA-2026-016640)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-016640 advisory. In Apache Derby 10.3.1.4 to 10.14.1.0, a specially-crafted network packet can be used to request the Derby Network Server to boot a database whose location and...
Security Bulletin: Multiple vulnerabilties affects IBM DB2 Data Management Console
Summary sshd-common-2.10.0.jar, dompurify-2.2.7.tgz, derby-10.16.1.1.jar, ion-java-1.2.0.jar dependency packages are being used by IBM Db2 Data Management Console. This bulletin describes the upgrades necessary to address the vulnerability. Vulnerability Details CVEID:CVE-2024-41909 DESCRIPTION:...
CVE-2025-65951 Inside Track / Entropy Derby Timelock Encryption Bypassed via Pre-Computed VDF Output Leakage
Inside Track / Entropy Derby is a research-grade horse-racing betting engine. Prior to commit 2d38d2f, the VDF-based timelock encryption system fails to enforce sequential delay against the betting operator. Bettors pre-compute the entire Wesolowski VDF and include vdfOutputHex in their encrypted...
CVE-2025-65951
CVE-2025-65951 affects Inside Track / Entropy Derby. Before commit 2d38d2f , the VDF-based timelock encryption did not enforce sequential delay against the betting operator, enabling bettors to pre-compute the Wesolowski VDF and include the output in encrypted bets. This allowed the house to decr...
CVE-2025-65951: Exposure of Sensitive Information to an Unauthorized Actor
Inside Track / Entropy Derby is a research-grade horse-racing betting engine. Prior to commit 2d38d2f, the VDF-based timelock encryption system fails to enforce sequential delay against the betting operator. Bettors pre-compute the entire Wesolowski VDF and include vdfOutputHex in their encrypted...
Security Bulletin: Due to the use of derby IBM webMethods BPM is vulnerable to unauthorized LDAP authentication
Summary IBM webMethods BPM is using derby which is affected by a known vulnerability CVE-2022-46337. This security bulletin provides guidance on addressing the vulnerability. Vulnerability Details CVEID:CVE-2022-46337 DESCRIPTION: A cleverly devised username might bypass LDAP authentication check...
EUVD-2006-7195
Malware in sbrugna...
EUVD-2022-5308
Malicious code in bioql PyPI...
EUVD-2022-2274
Malicious code in bioql PyPI...
EUVD-2022-5206
Malicious code in bioql PyPI...