Design/Logic Flaw

A flaw was found in the AMQ Broker that discloses JDBC encrypted usernames and passwords when provided in the AMQ Broker application logfile when using the jdbc persistence functionality. Versions shipped in Red Hat AMQ 7 are vulnerable...

CVE-2021-3425

CVE-2021-3425 affects Red Hat AMQ Broker (7.x). The issue: when using JDBC persistence, the broker logfile can disclose encrypted JDBC usernames and passwords, exposing credentials via log output. Root cause details are not explicitly enumerated in the provided documents, but the impact is creden...

CVE-2021-3425

A flaw was found in the AMQ Broker that discloses JDBC encrypted usernames and passwords when provided in the AMQ Broker application logfile when using the jdbc persistence functionality. Versions shipped in Red Hat AMQ 7 are vulnerable...

SQL Injection

storage-jdbc-hikaricp-plugin is vulnerable to SQL injection. The wildcard query cases when using H2/MySQL/TiDB allows an attacker to inject and execute arbitrary SQL statements...

SUSE: Security Advisory (SUSE-SU-2021:0599-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Remote Code Execution

Apache Druid is vulnerable to remote code execution. Certain properties supported by the MySQL JDBC driver allows an attacker to execute arbitrary code from a hacker-controlled malicious MySQL server within Druid server processes...

CVE-2021-26919

Apache Druid allows users to read data from other database systems using JDBC. This functionality is to allow trusted users with the proper permissions to set up lookups or submit ingestion tasks. The MySQL JDBC driver supports certain properties, which, if left unmitigated, can allow an attacker...

CVE-2021-26919

Apache Druid allows users to read data from other database systems using JDBC. This functionality is to allow trusted users with the proper permissions to set up lookups or submit ingestion tasks. The MySQL JDBC driver supports certain properties, which, if left unmitigated, can allow an attacker...

Code injection

Apache Druid allows users to read data from other database systems using JDBC. This functionality is to allow trusted users with the proper permissions to set up lookups or submit ingestion tasks. The MySQL JDBC driver supports certain properties, which, if left unmitigated, can allow an attacker...

CVE-2021-26919

CVE-2021-26919 affects Apache Druid, where allowing users with certain JDBC permissions to supply MySQL JDBC properties not on the allowed list could enable code execution in Druid server processes via a malicious MySQL server. Documented behavior: trusted users can set up lookups or ingestion ta...

CVE-2021-26919 Apache Druid Authenticated users can execute arbitrary code from malicious MySQL database systems.

Apache Druid allows users to read data from other database systems using JDBC. This functionality is to allow trusted users with the proper permissions to set up lookups or submit ingestion tasks. The MySQL JDBC driver supports certain properties, which, if left unmitigated, can allow an attacker...

CVE-2021-26919

Apache Druid allows users to read data from other database systems using JDBC. This functionality is to allow trusted users with the proper permissions to set up lookups or submit ingestion tasks. The MySQL JDBC driver supports certain properties, which, if left unmitigated, can allow an attacker...

Security Bulletin: IBM® Db2® is vulnerable to denial of service (CVE-2020-4200).

Summary Db2 is vulnerable to a denial of service. Authenticated users using a JDBC client may send specially crafted commands to cause Db2 to terminate abnormally. Vulnerability Details CVEID: CVE-2020-4200 DESCRIPTION: IBM DB2 for Linux, UNIX and Windows includes DB2 Connect Server could allow a...

NewStart CGSL MAIN 6.02 : postgresql-jdbc Vulnerability (NS-SA-2021-0087)

The remote NewStart CGSL host, running version MAIN 6.02, has postgresql-jdbc packages installed that are affected by a vulnerability: - PostgreSQL JDBC Driver aka PgJDBC before 42.2.13 allows XXE. CVE-2020-13692 Note that Nessus has not tested for this issue but has instead relied only on the...

NewStart CGSL CORE 5.04 / MAIN 5.04 : postgresql-jdbc Vulnerability (NS-SA-2021-0010)

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has postgresql-jdbc packages installed that are affected by a vulnerability: - PostgreSQL JDBC Driver aka PgJDBC before 42.2.13 allows XXE. CVE-2020-13692 Note that Nessus has not tested for this issue but has instead relied on...

CVE-2021-3425

A flaw was found in the AMQ Broker that discloses JDBC encrypted usernames and passwords when provided in the AMQ Broker application logfile when using the jdbc persistence functionality. Versions shipped in Red Hat AMQ 7 are vulnerable...

redhat AMQ 日志信息泄露漏洞

AMQ is a messaging middleware from Redhat that enables high-performance, secure, and reliable transfer of information between different services. A security vulnerability exists in redhat AMQ that arises from the disclosure of JDBC usernames and passwords in application logs...

SUSE-SU-2021:0599-1 Security update for postgresql-jdbc

This update for postgresql-jdbc fixes the following issues: - CVE-2020-13692: Fixed a XML External Entity vulnerability bsc1172746...

Huawei EulerOS: Security Advisory for postgresql-jdbc (EulerOS-SA-2021-1349)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

EulerOS 2.0 SP2 : postgresql-jdbc (EulerOS-SA-2021-1349)

According to the version of the postgresql-jdbc package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - PostgreSQL JDBC Driver aka PgJDBC before 42.2.13 allows XXE.CVE-2020-13692 Note that Tenable Network Security has extracted the preceding...