Duplicate Advisory: AWS Redshift JDBC Driver fails to validate class type during object instantiation

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-jc69-hjw2-fm86. This link is maintained to preserve external references. Original Description In Amazon AWS Redshift JDBC Driver aka amazon-redshift-jdbc-driver or redshift-jdbc42 before 2.1.0.8, the Object...

CVE-2022-41828

In Amazon AWS Redshift JDBC Driver aka amazon-redshift-jdbc-driver or redshift-jdbc42 before 2.1.0.8, the Object Factory does not check the class type when instantiating an object from a class name...

Design/Logic Flaw

In Amazon AWS Redshift JDBC Driver aka amazon-redshift-jdbc-driver or redshift-jdbc42 before 2.1.0.8, the Object Factory does not check the class type when instantiating an object from a class name...

PT-2022-26085 · Amazon · Amazon Redshift Jdbc Driver

Name of the Vulnerable Software and Affected Versions: Amazon AWS Redshift JDBC Driver versions prior to 2.1.0.8 Description: The Object Factory in the Amazon AWS Redshift JDBC Driver does not check the class type when instantiating an object from a class name. This issue can lead to a potential...

CVE-2022-41828

Summary: CVE-2022-41828 concerns the Amazon AWS Redshift JDBC Driver (redshift-jdbc42) prior to 2.1.0.8, where the Object Factory does not validate the target class type before instantiation, enabling potential remote code execution via crafted class names. Connected documents show concrete detai...

CVE-2022-41828

In Amazon AWS Redshift JDBC Driver aka amazon-redshift-jdbc-driver or redshift-jdbc42 before 2.1.0.8, the Object Factory does not check the class type when instantiating an object from a class name...

CVE-2022-41828

In Amazon AWS Redshift JDBC Driver aka amazon-redshift-jdbc-driver or redshift-jdbc42 before 2.1.0.8, the Object Factory does not check the class type when instantiating an object from a class name...

CVE-2022-41828

In Amazon AWS Redshift JDBC Driver aka amazon-redshift-jdbc-driver or redshift-jdbc42 before 2.1.0.8, the Object Factory does not check the class type when instantiating an object from a class name...

FreeBSD : puppetdb -- Potential SQL injection (aeb4c85b-3600-11ed-b52d-589cfc007716)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the aeb4c85b-3600-11ed-b52d-589cfc007716 advisory. - PostgreSQL JDBC Driver PgJDBC for short allows Java programs to connect to a PostgreSQL database usin...

Security Bulletin: Due to use of PostgreSQL JDBC Driver, IBM Cloud PAK for Watson AI Ops is vulnerable to SQL Injection (CVE-2022-31197)

Summary PostgreSQL JDBC Driver PgJDBC for short allows Java programs to connect to a PostgreSQL database using standard, database independent Java code. The PGJDBC implementation of the java.sql.ResultRow.refreshRow method is not performing escaping of column names so a malicious column name that...

USN-5238-1 libpgjava vulnerability

It was discovered that PostgreSQL JDBC Driver incorrectly handled certain requests from external entities. A remote attacker could use this vulnerability to cause a denial of service or possibly execute arbitrary code...

PT-2022-20605 · Databasir · Databasir

Name of the Vulnerable Software and Affected Versions: Databasir versions 1.06 and earlier Description: The issue allows attackers to perform Server-Side Request Forgery SSRF by sending a single HTTP POST request to create a databaseType. This is achieved by supplying a jdbcDriverFileUrl that...

The vulnerability of the JDBC driver of the Apache Calcite framework allows a hacker to execute arbitrary code.

The vulnerability of the JDBC framework driver of Apache Calcite Avatica is related to the use of uninitialized objects during the processing of the httpclientimpl parameter. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

SQL Injection

PostgreSQL JDBC Driver is vulnerable to SQL Injection. The vulnerability exists in java.sql.ResultRow.RefreshRow function because it's not properly escaping column names which allows a remote attacker to inject and execute malicious sql code into the system...

CVE-2022-31197

PostgreSQL JDBC Driver PgJDBC for short allows Java programs to connect to a PostgreSQL database using standard, database independent Java code. The PGJDBC implementation of the java.sql.ResultRow.refreshRow method is not performing escaping of column names so a malicious column name that contain...

CVE-2022-31197

PostgreSQL JDBC Driver PgJDBC for short allows Java programs to connect to a PostgreSQL database using standard, database independent Java code. The PGJDBC implementation of the java.sql.ResultRow.refreshRow method is not performing escaping of column names so a malicious column name that contain...

[SECURITY] [DSA 5196-1] libpgjava security update

------------------------------------------------------------------------- Debian Security Advisory DSA-5196-1 [email protected] https://www.debian.org/security/ Markus Koschany July 31, 2022 https://www.debian.org/security/faq -...

Debian DSA-5196-1 : libpgjava - security update

The remote Debian 10 / 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5196 advisory. - PostgreSQL JDBC Driver aka PgJDBC before 42.2.13 allows XXE. CVE-2020-13692 - pgjdbc is the offical PostgreSQL JDBC Driver. A security hole was found in th...

Apache Calcite Code Injection Vulnerability

Apache Calcite is an open source framework from the US Apache Apache Foundation for building databases and data management systems. A code injection vulnerability exists in the Apache Calcite Avatica JDBC driver, which stems from the fact that classes are not verified to implement the expected...

GHSA-W7F5-JRPR-5C2M Apache Calcite Avatica JDBC driver arbitrary code execution

Apache Calcite Avatica JDBC driver creates HTTP client instances based on class names provided via httpclientimpl connection property; however, the driver does not verify if the class implements the expected interface before instantiating it, which can lead to code execution loaded via arbitrary...