207 matches found
Unauthorized File Access
duckdb is vulnerable to Unauthorized File Access. The vulnerability is due to inadequate restrictions in the sniffcsv function, allowing access to the filesystem even when enableexternalaccess=false. Attackers can exploit this by reading content from files such as /etc/hosts and proc/self/environ...
CVE-2024-41672
DuckDB is a SQL database management system. In versions 1.0.0 and prior, content in filesystem is accessible for reading using sniffcsv, even with enableexternalaccess=false. This vulnerability provides an attacker with access to filesystem even when access is expected to be disabled and other...
PYSEC-2024-203
DuckDB is a SQL database management system. In versions 1.0.0 and prior, content in filesystem is accessible for reading using sniffcsv, even with enableexternalaccess=false. This vulnerability provides an attacker with access to filesystem even when access is expected to be disabled and other...
PYSEC-2024-203
DuckDB is a SQL database management system. In versions 1.0.0 and prior, content in filesystem is accessible for reading using sniffcsv, even with enableexternalaccess=false. This vulnerability provides an attacker with access to filesystem even when access is expected to be disabled and other...
CVE-2024-41672 DuckDB: sniff_csv provides filesystem access even when enable_external_access is disabled
DuckDB is a SQL database management system. In versions 1.0.0 and prior, content in filesystem is accessible for reading using sniffcsv, even with enableexternalaccess=false. This vulnerability provides an attacker with access to filesystem even when access is expected to be disabled and other...
CVE-2024-41672
DuckDB is a SQL database management system. In versions 1.0.0 and prior, content in filesystem is accessible for reading using sniffcsv, even with enableexternalaccess=false. This vulnerability provides an attacker with access to filesystem even when access is expected to be disabled and other...
CVE-2024-41672 DuckDB: sniff_csv provides filesystem access even when enable_external_access is disabled
DuckDB is a SQL database management system. In versions 1.0.0 and prior, content in filesystem is accessible for reading using sniffcsv, even with enableexternalaccess=false. This vulnerability provides an attacker with access to filesystem even when access is expected to be disabled and other...
CVE-2024-41672
CVE-2024-41672 affects DuckDB prior to 1.1.0. In versions 1.0.0 and earlier, content on the filesystem could be read via the sniff_csv function even when enable_external_access is false, giving an attacker access to files that should be restricted (for example /etc/hosts, /proc/self/environ). Two...
CVE-2024-41672 DuckDB: sniff_csv provides filesystem access even when enable_external_access is disabled
DuckDB is a SQL database management system. In versions 1.0.0 and prior, content in filesystem is accessible for reading using sniffcsv, even with enableexternalaccess=false. This vulnerability provides an attacker with access to filesystem even when access is expected to be disabled and other...
CVE-2024-41672: Exposure of Sensitive Information to an Unauthorized Actor
DuckDB is a SQL database management system. In versions 1.0.0 and prior, content in filesystem is accessible for reading using sniffcsv, even with enableexternalaccess=false. This vulnerability provides an attacker with access to filesystem even when access is expected to be disabled and other...
DuckDB 安全漏洞
DuckDB is an in-process SQL OLAP database management system from DuckDB open source. A security vulnerability exists in DuckDB 1.0.0 and earlier versions, which stems from the ability of sniffcsv to provide file system access even when enableexternalaccess is disabled, which could allow an attack...
PT-2024-5331 · Duckdb · Duckdb
Name of the Vulnerable Software and Affected Versions: DuckDB versions 1.0.0 and prior Description: The issue is related to the sniff csv function in DuckDB, which allows access to the filesystem even when enable external access is set to false. This provides an attacker with unauthorized access ...
CVE-2024-5827
Vanna v0.3.4 is vulnerable to SQL injection in its DuckDB integration exposed to its Flask Web APIs. Attackers can inject malicious SQL training data and generate corresponding queries to write arbitrary files on the victim's file system, such as backdoor.php with contents . This can lead to...
CVE-2024-5827 Arbitrary File Write by Prompt Injection via DuckDB SQL in vanna-ai/vanna
Vanna v0.3.4 is vulnerable to SQL injection in its DuckDB integration exposed to its Flask Web APIs. Attackers can inject malicious SQL training data and generate corresponding queries to write arbitrary files on the victim's file system, such as backdoor.php with contents . This can lead to...
CVE-2024-5827 Arbitrary File Write by Prompt Injection via DuckDB SQL in vanna-ai/vanna
Vanna v0.3.4 is vulnerable to SQL injection in its DuckDB integration exposed to its Flask Web APIs. Attackers can inject malicious SQL training data and generate corresponding queries to write arbitrary files on the victim's file system, such as backdoor.php with contents . This can lead to...
CVE-2024-5827: Improper Neutralization of Special Elements used in an SQL Command
Vanna v0.3.4 is vulnerable to SQL injection in its DuckDB integration exposed to its Flask Web APIs. Attackers can inject malicious SQL training data and generate corresponding queries to write arbitrary files on the victim's file system, such as backdoor.php with contents . This can lead to...
PT-2024-5388 · Duckdb +2 · Duckdb +2
Name of the Vulnerable Software and Affected Versions: Vanna version 0.3.4 Description: The issue is related to the Vanna framework's web interface, specifically with its integration of DuckDB and Flask Web APIs. It allows for SQL injection, enabling attackers to inject malicious SQL training dat...
CVE-2024-22682
Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none...
