dbt (0.19.1rc1), dbt-bigquery (0.19.1rc1) +3 more potentially affected by CVE-2024-36105 via dbt-core (0.19.1rc1)

dbt-core PYPI version 0.19.1rc1 is affected by a known vulnerability. The following packages have a transitive dependency on dbt-core and may be impacted: - dbt 0.19.1rc1 - dbt-bigquery 0.19.1rc1 - dbt-postgres 0.19.1rc1 - dbt-redshift 0.19.1rc1 - dbt-spark 0.19.1rc1 Source cves: CVE-2024-36105...

dbt (0.19.1rc2), dbt-bigquery (0.19.1rc2) +2 more potentially affected by CVE-2024-36105 via dbt-core (0.19.1rc2)

dbt-core PYPI version 0.19.1rc2 is affected by a known vulnerability. The following packages have a transitive dependency on dbt-core and may be impacted: - dbt 0.19.1rc2 - dbt-bigquery 0.19.1rc2 - dbt-postgres 0.19.1rc2 - dbt-redshift 0.19.1rc2 Source cves: CVE-2024-36105 Source advisory:...

airflow-dbt-python (>=0.2.0, <=0.5.0), dbt (0.19.2) +14 more potentially affected by CVE-2024-36105 via dbt-core (0.19.2)

dbt-core PYPI version 0.19.2 is affected by a known vulnerability. The following packages have a transitive dependency on dbt-core and may be impacted: - airflow-dbt-python =0.2.0, =0.1.0, =0.4.0, =0.1.0, =0.19.0, =0.5.0, =0.5.2 and more Source cves: CVE-2024-36105 Source advisory:...

dbt (0.20.2rc1), dbt-bigquery (0.20.2rc1) +5 more potentially affected by CVE-2024-36105 via dbt-core (0.20.2rc1)

dbt-core PYPI version 0.20.2rc1 is affected by a known vulnerability. The following packages have a transitive dependency on dbt-core and may be impacted: - dbt 0.20.2rc1 - dbt-bigquery 0.20.2rc1 - dbt-postgres 0.20.2rc1 - dbt-presto 0.20.2rc1 - dbt-redshift 0.20.2rc1 - dbt-snowflake 0.20.2rc1 -...

data-pipelines-cli (0.31.0), dbt-dremio (1.7.0) +12 more potentially affected by CVE-2024-36105 via dbt-core (>=1.7.0, <=1.7.14)

dbt-core PYPI version =1.7.0, =1.7.0, =0.0.2, =0.5.0, =1.7.0, =1.7.0, =0.0.4, =0.4.3, =0.1.0, =0.0.1rc8, =0.2.1, =0.1.0, =0.2.1 Source cves: CVE-2024-36105 Source advisory: OSV:GHSA-PMRX-695R-4349...

dbt (0.15.3rc1), dbt-bigquery (0.15.3rc1) +3 more potentially affected by CVE-2024-36105 via dbt-core (0.15.3rc1)

dbt-core PYPI version 0.15.3rc1 is affected by a known vulnerability. The following packages have a transitive dependency on dbt-core and may be impacted: - dbt 0.15.3rc1 - dbt-bigquery 0.15.3rc1 - dbt-postgres 0.15.3rc1 - dbt-redshift 0.15.3rc1 - dbt-snowflake 0.15.3rc1 Source cves: CVE-2024-361...

dbt (0.16.0rc1), dbt-bigquery (0.16.0rc1) +3 more potentially affected by CVE-2024-36105 via dbt-core (0.16.0rc1)

dbt-core PYPI version 0.16.0rc1 is affected by a known vulnerability. The following packages have a transitive dependency on dbt-core and may be impacted: - dbt 0.16.0rc1 - dbt-bigquery 0.16.0rc1 - dbt-postgres 0.16.0rc1 - dbt-redshift 0.16.0rc1 - dbt-snowflake 0.16.0rc1 Source cves: CVE-2024-361...

dbt (0.16.1rc1), dbt-bigquery (0.16.1rc1) +3 more potentially affected by CVE-2024-36105 via dbt-core (0.16.1rc1)

dbt-core PYPI version 0.16.1rc1 is affected by a known vulnerability. The following packages have a transitive dependency on dbt-core and may be impacted: - dbt 0.16.1rc1 - dbt-bigquery 0.16.1rc1 - dbt-postgres 0.16.1rc1 - dbt-redshift 0.16.1rc1 - dbt-snowflake 0.16.1rc1 Source cves: CVE-2024-361...

dbt (0.16.1), dbt-bigquery (0.16.1) +6 more potentially affected by CVE-2024-36105 via dbt-core (0.16.1)

dbt-core PYPI version 0.16.1 is affected by a known vulnerability. The following packages have a transitive dependency on dbt-core and may be impacted: - dbt 0.16.1 - dbt-bigquery 0.16.1 - dbt-postgres 0.16.1 - dbt-presto 0.16.1 - dbt-redshift 0.16.1 - dbt-snowflake 0.16.1 - dbt-spark 0.16.1 - dd...

data-pipelines-cli (0.31.0), dbt-dremio (1.7.0) +12 more potentially affected by CVE-2024-36105 via dbt-core (>=1.7.0, <=1.7.14)

dbt-core PYPI version =1.7.0, =1.7.0, =0.0.2, =0.5.0, =1.7.0, =1.7.0, =0.0.4, =0.4.3, =0.1.0, =0.0.1rc8, =0.2.1, =0.1.0, =0.2.1 Source cves: CVE-2024-36105 Source advisory: MEND:CVE-2024-36105...

laravel framework SQL Injection via limit and offset functions

Impact Those using SQL Server with Laravel and allowing user input to be passed directly to the limit and offset functions are vulnerable to SQL injection. Other database drivers such as MySQL and Postgres are not affected by this vulnerability. Patches This problem has been patched on Laravel...

GHSA-X3WM-HFFR-CHWM Amazon JDBC Driver for Redshift SQL Injection via line comment generation

Impact SQL injection is possible when using the non-default connection property preferQueryMode=simple in combination with application code which has a vulnerable SQL that negates a parameter value. There is no vulnerability in the driver when using the default, extended query mode. Note that...

CVE-2024-32888 Amazon JDBC Driver for Redshift SQL Injection via line comment generation

The Amazon JDBC Driver for Redshift is a Type 4 JDBC driver that provides database connectivity through the standard JDBC application program interfaces APIs available in the Java Platform, Enterprise Editions. Prior to version 2.1.0.28, SQL injection is possible when using the non-default...

CVE-2024-4545

All versions of EnterpriseDB Postgres Advanced Server EPAS from 15.0 prior to 15.7.0 and from 16.0 prior to 16.3.0 may allow users using edbldr to bypass role permissions from pgreadserverfiles. This could allow low privilege users to read files to which they would not otherwise have access...

CVE-2024-4545: Improper Privilege Management

All versions of EnterpriseDB Postgres Advanced Server EPAS from 15.0 prior to 15.7.0 and from 16.0 prior to 16.3.0 may allow users using edbldr to bypass role permissions from pgreadserverfiles. This could allow low privilege users to read files to which they would not otherwise have access...

CVE-2024-4545

CVE-2024-4545 affects EnterpriseDB Postgres Advanced Server (EPAS). All EPAS versions 15.0 up to 15.7.0 and 16.0 up to 16.3.0 permit users using edbldr to bypass role permissions from pg_read_server_files, allowing low-privilege users to read files they would normally be unable to access. The und...

CVE-2024-4545 EDB Postgres Advanced Server (EPAS) authenticated file read permissions bypass using edbldr

All versions of EnterpriseDB Postgres Advanced Server EPAS from 15.0 prior to 15.7.0 and from 16.0 prior to 16.3.0 may allow users using edbldr to bypass role permissions from pgreadserverfiles. This could allow low privilege users to read files to which they would not otherwise have access...

Npgsql vulnerable to SQL Injection via Protocol Message Size Overflow

Summary The WriteBind method in src/Npgsql/Internal/NpgsqlConnector.FrontendMessages.cs uses int variables to store the message length and the sum of parameter lengths. Both variables overflow when the sum of parameter lengths becomes too large. This causes Npgsql to write a message size that is...

PT-2024-31639

Name of the Vulnerable Software and Affected Versions: EnterpriseDB Postgres Advanced Server EPAS versions 15.0 through 15.6.x EnterpriseDB Postgres Advanced Server EPAS versions 16.0 through 16.2.x Description: The issue allows users utilizing edbldr to bypass role permissions from pg read serve...

The Postgres implementation in Brocade SANnav versions before 2.3.0a is vulnerable to an incorrect local authentication flaw (CVE-2024-2860)

The Postgres implementation in Brocade SANnav versions before 2.3.0a is vulnerable to an incorrect local authentication flaw. An attacker with access to the VM where the Brocade SANnav is installed can gain access to sensitive data inside the Postgres database...