54 matches found
Apache NiFi H2 Connection String Remote Code Execution
The DBCPConnectionPool and HikariCPConnectionPool Controller Services in Apache NiFi 0.0.2 through 1.21.0 allow an authenticated and authorized user to configure a Database URL with the H2 driver that enables custom code execution. This exploit will result in several shells 5-7. Successfully test...
h2: Remote Code Execution in Console
A flaw was found in h2. The org.h2.util.JdbcUtils.getConnection method of the H2 database takes as parameters the class name of the driver and URL of the database. This flaw allows an attacker to use this URL to send another server’s code, causing remote code execution. This issue is exploited...
npm heroku-env 命令注入漏洞
npm heroku-env is a package from npm USA. It is used to parse DATABASEURL from heroku configuration and split it into PG environment variables used by psql pgdump pgrestore and nodepostgres. A command injection vulnerability exists in versions of heroku-env prior to 2.0.2, which stems from the...
npm heroku-env 命令注入漏洞
npm heroku-env is a package from npm USA. It is used to parse DATABASEURL from heroku configurations and split it into PG environment variables used by psql pgdump pgrestore and nodepostgres. A command injection vulnerability exists in all versions of heroku-env, which stems from the presence of...
h2: Loading of custom classes from remote servers through JNDI
A flaw was found in the H2 Console. This flaw allows remote attackers to execute arbitrary code via a JDBC URL, concatenating with a substring that allows remote code execution by using a script...
h2: Loading of custom classes from remote servers through JNDI
A flaw was found in the H2 Console. This flaw allows remote attackers to execute arbitrary code via a JDBC URL, concatenating with a substring that allows remote code execution by using a script...
h2: Remote Code Execution in Console
A flaw was found in h2. The org.h2.util.JdbcUtils.getConnection method of the H2 database takes as parameters the class name of the driver and URL of the database. This flaw allows an attacker to use this URL to send another server’s code, causing remote code execution. This issue is exploited...
h2: Loading of custom classes from remote servers through JNDI
A flaw was found in the H2 Console. This flaw allows remote attackers to execute arbitrary code via a JDBC URL, concatenating with a substring that allows remote code execution by using a script...
H2database代码问题漏洞
H2 database is an embeddable Rdbms written in Java . A code issue vulnerability exists in H2 database, which stems from the H2 database's getConnection method taking the driver's class name and the database's URL as parameters, which can be exploited by an attacker to pass the name of the JNDI...
Command Injection
Overview heroku-env is a package that parse the DATABASEURL from your heroku config and split it out into the PG environment variables used by psql pgdump pgrestore and nodepostgres Affected versions of this package are vulnerable to Command Injection. The injection point is located in lib/get.js...
PT-2020-15456 · Jenkins · Jenkins Pipeline Maven Integration Plugin +1
Name of the Vulnerable Software and Affected Versions: Jenkins Pipeline Maven Integration Plugin versions 3.8.2 and earlier Description: A cross-site request forgery CSRF vulnerability exists, allowing attackers to connect to an attacker-specified JDBC URL using attacker-specified credentials IDs...
CVE-2012-5380
creationtimestamp| type| source ---|---|--- 2013-09-06 00:00:00+00:00| confirmed| https://www.exploit-db.com/exploits/28130...