MAL-2025-2359 Malicious code in aiven-docs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f7ef5fbee116dc7c6a033971fa455298110b289026b14470eb6120ae7aa06467 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in aiven-docs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f7ef5fbee116dc7c6a033971fa455298110b289026b14470eb6120ae7aa06467 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Akamai Managed Database Services: Powered by Aiven

Akamai has partnered with Aiven, a leading global managed database provider, to offer customers a streamlined way to offload the complexities of database setup, configuration, patching, backups, and scaling...

The vulnerability of the aiven-extras extension of the PostgreSQL database management system allows a hacker to gain superuser privileges, execute arbitrary code, and disclose sensitive information.

The vulnerability of the aiven-extras extension in the PostgreSQL database management system is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to gain superuser privileges, execute arbitrary code, and disclose sensitive information...

CVE-2023-32305

aiven-extras is a PostgreSQL extension. Versions prior to 1.1.9 contain a privilege escalation vulnerability, allowing elevation to superuser inside PostgreSQL databases that use the aiven-extras package. The vulnerability leverages missing schema qualifiers on privileged functions called by the...

CVE-2023-32305

CVE-2023-32305 affects the PostgreSQL extension aiven-extras . The root cause is missing schema qualifiers on privileged functions called by the extension, allowing a low-privilege user to create objects that collide with existing function names and have them executed, enabling escalation to the ...

CVE-2023-32305 aiven-extras PostgreSQL Privilege Escalation Through Overloaded Search Path

aiven-extras is a PostgreSQL extension. Versions prior to 1.1.9 contain a privilege escalation vulnerability, allowing elevation to superuser inside PostgreSQL databases that use the aiven-extras package. The vulnerability leverages missing schema qualifiers on privileged functions called by the...

PT-2023-2939 · Aiven · Aiven-Extras

Name of the Vulnerable Software and Affected Versions: aiven-extras versions prior to 1.1.9 Description: The issue is related to a privilege escalation vulnerability in the aiven-extras PostgreSQL extension. It allows a low-privileged user to elevate to superuser inside PostgreSQL databases that...

aiven-extras 安全漏洞

aiven-extras is a tool that enables non-super users to access certain database functions. A security vulnerability exists in aiven-extras versions prior to 1.1.9, which contains an elevation of privilege vulnerability that can be exploited by an attacker to gain superuser privileges, allowing...

Aiven Ltd: [Kafka Connect] [JdbcSinkConnector][HttpSinkConnector] RCE by leveraging file upload via SQLite JDBC driver and SSRF to internal Jolokia

Summary: The Aiven JDBC sink includes the SQLite JDBC Driver. This JDBC driver can be used to upload SQLite database files onto the server. The HTTP sink connector allows sending HTTP requests to localhost. There is unprotected Jolokia listening on localhost:6725. JMX exports the...

Aiven Ltd: Kafka Connect RCE via connector SASL JAAS JndiLoginModule configuration

Summary: When configuring the connector via the Aiven API or the Kafka Connect REST API, the attacker can set the database.history.producer.sasl.jaas.config connector property for the io.debezium.connector.mysql.MySqlConnector connector. This is likely true for other debezium connectors too. By...

Aiven Ltd: 0-day Cross Origin Request Forgery vulnerability in Grafana 8.x .

Disclaimer To triage, please note that this is still a 0-day that was alerted to Grafana already, in order to make sure the client is safe I report this issue now, please make sure to not spread it further or leak it, as the best interest is to let you be aware and safer from any potential attack...

Aiven Ltd: Apache Flink RCE via GET jar/plan API Endpoint

Summary: Aiven has not restricted access to the GET jars/jarid/plan API. This endpoint can be used to load java class files with the specified arguments that are in the java classpath on the server. This can be abused to gain RCE on the Apache Flink Server. Steps To Reproduce: The video below sho...

Aiven Ltd: Zero day path traversal vulnerability in Grafana 8.x allows unauthenticated arbitrary local file read

Summary: Hi team, I've found a path traversal issue in the Grafana instances hosted on the Aiven platforms. With the path traversal it's possible for an unauthenticated user to read arbitrary files on the server. Steps To Reproduce: 1. Login at https://console.aiven.io 1. Create a new Grafana...

Aiven Ltd: Grafana RCE via SMTP server parameter injection

Summary: This report is similar to 1180653, except with different parameter injection entrypoint. SMTP server password configuration setting accepts new line characters. This can be used to set non-exported configuration variables. Using this CRLF-injection, the renderingargs of grafana image...