CVE-2023-27868

CVE-2023-27868 (IBM Db2 JDBC Driver): A remote authenticated attacker could execute arbitrary code due to an unchecked class instantiation when providing plugin classes, via a crafted request using the pluginClassName field. Affected: IBM Db2 JDBC Driver for Db2 on Linux/UNIX/Windows 10.5, 11.1, ...

CVE-2023-27867

CVE-2023-27867 affects IBM Db2 JDBC Driver for Db2 on Linux/UNIX/Windows (10.5, 11.1, 11.5). A remote authenticated attacker could execute arbitrary code via JNDI Injection by sending a crafted request using the clientRerouteServerListJNDIName property. The connected IBM advisories confirm this i...

CVE-2023-27867 IBM Db2 code execution

IBM Db2 JDBC Driver for Db2 for Linux, UNIX and Windows 10.5, 11.1, and 11.5 could allow a remote authenticated attacker to execute arbitrary code via JNDI Injection. By sending a specially crafted request using the property clientRerouteServerListJNDIName, an attacker could exploit this...

CVE-2023-27869

CVE-2023-27869 affects IBM Db2 JDBC Driver for Db2 on Linux/UNIX/Windows (versions 10.5, 11.1, 11.5). The issue is caused by an unchecked logger injection via the named traceFile property, enabling a remote authenticated attacker to execute arbitrary code on the system. IBM bulletins list this al...

PT-2023-5225 · Ibm · Ibm Db2 Jdbc Driver

Name of the Vulnerable Software and Affected Versions: IBM Db2 JDBC Driver for Db2 for Linux, UNIX and Windows versions 10.5, 11.1, and 11.5 Description: The issue is related to incorrect code generation management in the IBM DB2 JDBC driver, which could allow a remote authenticated attacker to...

PT-2023-5228 · Ibm · Ibm Db2 Jdbc Driver

Name of the Vulnerable Software and Affected Versions: IBM Db2 JDBC Driver for Db2 for Linux, UNIX and Windows versions 10.5, 11.1, and 11.5 Description: The issue is related to incorrect code generation management in the IBM DB2 database management system's JDBC client driver. It allows a remote...

Security Bulletin: IBM DataPower Gateway affected by multiple issues in JRE

Summary IBM has addressed the following CVEs, which potentially affect JDBC, IMS Callout and JMS components Vulnerability Details CVEID:CVE-2023-21930 DESCRIPTION: An unspecified vulnerability in Oracle Java SE, Oracle GraalVM Enterprise Edition related to the JSSE component could allow an...

Apache Airflow JDBC Provider Code Execution Vulnerability

Apache Airflow is the United States Apache Apache Foundation's set of open source platform for creating, managing and monitoring workflow. A code execution vulnerability exists in Apache Airflow JDBC Provider, which can be exploited by an attacker to execute arbitrary code on a system...

Remote Code Execution (RCE)

apache-airflow-providers-jdbc is vulnerable to Remote Code Execution RCE. The vulnerability exists because the library does not properly restrict the driver params via JDBC connection, which allows an attacker to inject and execute malicious code and obtain airflow server permission...

Critical: Red Hat Security Advisory: Red Hat Fuse 7.12 release and security update

A minor version update from 7.11 to 7.12 is now available for Red Hat Fuse. The purpose of this text-only errata is to inform you about the security issues fixed in this release. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring...

GHSA-MM87-C3X2-6F89 Apache Airflow JDBC Provider Improper Input Validation vulnerability

Improper Input Validation vulnerability in Apache Software Foundation Apache Airflow JDBC Provider. Airflow JDBC Provider Connection’s Connection URL parameters had no restrictions, which made it possible to implement RCE attacks via different type JDBC drivers, obtain airflow server permission...

Apache Airflow JDBC Provider Improper Input Validation vulnerability

Improper Input Validation vulnerability in Apache Software Foundation Apache Airflow JDBC Provider. Airflow JDBC Provider Connection’s Connection URL parameters had no restrictions, which made it possible to implement RCE attacks via different type JDBC drivers, obtain airflow server permission...

CVE-2023-22886

Improper Input Validation vulnerability in Apache Software Foundation Apache Airflow JDBC Provider. Airflow JDBC Provider Connection’s Connection URL parameters had no restrictions, which made it possible to implement RCE attacks via different type JDBC drivers, obtain airflow server permission...

CVE-2023-22886

Improper Input Validation vulnerability in Apache Software Foundation Apache Airflow JDBC Provider. Airflow JDBC Provider Connection’s Connection URL parameters had no restrictions, which made it possible to implement RCE attacks via different type JDBC drivers, obtain airflow server permission...

Input validation

Improper Input Validation vulnerability in Apache Software Foundation Apache Airflow JDBC Provider. Airflow JDBC Provider Connection’s Connection URL parameters had no restrictions, which made it possible to implement RCE attacks via different type JDBC drivers, obtain airflow server permission...

CVE-2023-22886 Apache Airflow JDBC Provider: RCE Vulnerability

Improper Input Validation vulnerability in Apache Software Foundation Apache Airflow JDBC Provider. Airflow JDBC Provider Connection’s Connection URL parameters had no restrictions, which made it possible to implement RCE attacks via different type JDBC drivers, obtain airflow server permission...

CVE-2023-22886

Summary: CVE-2023-22886 relates to an Improper Input Validation vulnerability in the Apache Airflow JDBC Provider (pre-4.0.0). What is affected: Apache Airflow JDBC Provider and its Connection URL handling. Root cause / impact: The Connection URL parameters had no restrictions, enabling potential...

CVE-2023-22886 Apache Airflow JDBC Provider: RCE Vulnerability

Improper Input Validation vulnerability in Apache Software Foundation Apache Airflow JDBC Provider. Airflow JDBC Provider Connection’s Connection URL parameters had no restrictions, which made it possible to implement RCE attacks via different type JDBC drivers, obtain airflow server permission...

CVE-2023-27866

IBM Informix JDBC Driver 4.10 and 4.50 is susceptible to remote code execution attack via JNDI injection when driver code or the application using the driver do not verify supplied LDAP URL in Connect String. IBM X-Force ID: 249511...

Remote code execution

IBM Informix JDBC Driver 4.10 and 4.50 is susceptible to remote code execution attack via JNDI injection when driver code or the application using the driver do not verify supplied LDAP URL in Connect String. IBM X-Force ID: 249511...