CVE-2022-36364

Apache Calcite Avatica JDBC driver creates HTTP client instances based on class names provided via httpclientimpl connection property; however, the driver does not verify if the class implements the expected interface before instantiating it, which can lead to code execution loaded via arbitrary...

CVE-2022-36364

Apache Calcite Avatica JDBC driver creates HTTP client instances based on class names provided via httpclientimpl connection property; however, the driver does not verify if the class implements the expected interface before instantiating it, which can lead to code execution loaded via arbitrary...

Code injection

Apache Calcite Avatica JDBC driver creates HTTP client instances based on class names provided via httpclientimpl connection property; however, the driver does not verify if the class implements the expected interface before instantiating it, which can lead to code execution loaded via arbitrary...

CVE-2022-36364 Apache Calcite Avatica JDBC driver `httpclient_impl` connection property can be used as an RCE vector

Apache Calcite Avatica JDBC driver creates HTTP client instances based on class names provided via httpclientimpl connection property; however, the driver does not verify if the class implements the expected interface before instantiating it, which can lead to code execution loaded via arbitrary...

CVE-2022-36364

Apache Calcite Avatica JDBC driver is affected by CVE-2022-36364 due to insecure dynamic instantiation of httpclient_impl classes without validating they implement the expected interface, enabling potential code execution loaded from arbitrary classes. The issue is addressed starting with Avatica...

EulerOS 2.0 SP8 : postgresql-jdbc (EulerOS-SA-2022-1946)

According to the versions of the postgresql-jdbc package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - pgjdbc is the offical PostgreSQL JDBC Driver. A security hole was found in the jdbc driver for postgresql database while doing security...

Security Bulletin: Vulnerability in PostgreSQL may affect IBM Spectrum Copy Data Management

Summary PostgreSQL could allow a remote attacker to gain unauthorized access to the system which may affect IBM Spectrum Copy Data Management. Vulnerability Details IBM X-Force ID: 220313 DESCRIPTION: PostgreSQL JDBC Driver could allow a remote attacker to gain unauthorized access to the system,...

Debian DLA-3018-1 : libpgjava - LTS security update

The remote Debian 9 host has packages installed that are affected by a vulnerability as referenced in the dla-3018 advisory. - pgjdbc is the offical PostgreSQL JDBC Driver. A security hole was found in the jdbc driver for postgresql database while doing security research. The system using the...

[SECURITY] [DLA 3018-1] libpgjava security update

Debian LTS Advisory DLA-3018-1 [email protected] https://www.debian.org/lts/security/ Markus Koschany May 20, 2022 https://wiki.debian.org/LTS Package : libpgjava Version : 9.4.1212-1+deb9u1 CVE ID : CVE-2022-21724 It was found that libpgjava, the official PostgreSQL JDBC Driver, would ...

Unescaped parameters in the PostgreSQL JDBC driver

Interaction error in the PostgreSQL JDBC driver before 8.2, when used with a PostgreSQL server with the "standardconformingstrings" option enabled, such as the default configuration of PostgreSQL 9.1, does not properly escape unspecified JDBC statement parameters, which allows remote attackers to...

CVE-2022-30240

An argument injection vulnerability in the browser-based authentication component of the Magnitude Simba Amazon Redshift JDBC Driver 1.2.40 through 1.2.55 may allow a local user to execute code. NOTE: this is different from CVE-2022-29972...

CVE-2022-30240

An argument injection vulnerability in the browser-based authentication component of the Magnitude Simba Amazon Redshift JDBC Driver 1.2.40 through 1.2.55 may allow a local user to execute code. NOTE: this is different from CVE-2022-29972...

CVE-2022-30239

An argument injection vulnerability in the browser-based authentication component of the Magnitude Simba Amazon Athena JDBC Driver 2.0.25 through 2.0.28 may allow a local user to execute code. NOTE: this is different from CVE-2022-29971...

Design/Logic Flaw

An argument injection vulnerability in the browser-based authentication component of the Magnitude Simba Amazon Athena JDBC Driver 2.0.25 through 2.0.28 may allow a local user to execute code. NOTE: this is different from CVE-2022-29971...

CVE-2022-30240

An argument injection vulnerability in the browser-based authentication component of the Magnitude Simba Amazon Redshift JDBC Driver 1.2.40 through 1.2.55 may allow a local user to execute code. NOTE: this is different from CVE-2022-29972...

CVE-2022-30240

Technical details about CVE-2022-30240 are not publicly available in the provided documents. No affected versions, root-cause specifics, exploit info, or remediation are given here. Monitor for updates from the referenced advisories.

CVE-2022-30239

CVE-2022-30239 describes an argument injection vulnerability in the browser-based authentication component of the Magnitude Simba Amazon Athena JDBC Driver, affected in versions 2.0.25 through 2.0.28. The underlying issue enables a local user to execute code due to improper handling in the authen...

Magnitude Simba Amazon Athena JDBC Driver 参数注入漏洞

Magnitude Simba Amazon Athena JDBC Driver is a JDBC driver from Magnitude, Inc. It is used to connect to live Amazon Athena data directly from any application that supports JDBC connections. A parameter injection vulnerability exists in Magnitude Simba Amazon Athena JDBC Driver versions 2.0.25...

Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in PostgreSQL

Summary IBM Watson Discovery for IBM Cloud Pak for Data contains a vulnerable version of Java.PostgreSQL JDBC Driver. The vulnerability is more difficult to expolit since it is an internal component protected from direct access. Vulnerability Details IBM X-Force ID: 220313 DESCRIPTION: PostgreSQL...

Aiven Ltd: [Kafka Connect] [JdbcSinkConnector][HttpSinkConnector] RCE by leveraging file upload via SQLite JDBC driver and SSRF to internal Jolokia

Summary: The Aiven JDBC sink includes the SQLite JDBC Driver. This JDBC driver can be used to upload SQLite database files onto the server. The HTTP sink connector allows sending HTTP requests to localhost. There is unprotected Jolokia listening on localhost:6725. JMX exports the...