194 matches found
CVE-2024-56428
CVE-2024-56428 iLabClient 本地数据库中的明文凭据 读取包含密码的配置 iLabClient 用于从实验室服务器下载结果。配置数据 存储在本地 Apache Derby 实例 iLabClient 中。密码以明文形式存储。为了能够读取该密码，必须首先建立到本地数据库的连接，例如按照 CVE-2024-56429 中描述的方式操作。 读取密码： root@kitploit: select EINSTELLUNGEN from configs; 自动化脚本 可以执行 getconfigs.sh 脚本以读取配置数据。需要注意的是， 在执行期间，不得有其他程序（例如...
Nacos <1.4.1 - Authentication Bypass
Nacos before version 1.4.1 is vulnerable to authentication bypass because the ConfigOpsController lets the user perform management operations like querying the database or even wiping it out. While the /data/remove endpoint is properly protected with the @Secured annotation, the /derby endpoint i...
CVE-2024-56429
CVE-2024-56429 iLabClient のローカルデータベースへのアクセス データベースのパスワードを抽出する iLabClient は、ローカルに必要なデータを保存するために Apache Derby データベースを使用します。暗号化を保証するために、 作成時に bootPassword が使用されます。これはソースコードから抽出できます 抽出されたコードは DecyptedBootPassword.java にあります。抽出されたソースコードを実行すると、 ユーザーは bootPassword を受け取ります。 root@kitploit:...
cve-2021-29442-Nacos-Derby-rce-exp
简介 Nacos Derby命令执行漏洞利用脚本，默认使用User-Agent绕过漏洞进行利用 Nacos 是一款用于服务注册、发现和配置管理的开源平台。在其早期版本（≤2.4.0-BETA）中，Nacos 默认集成了 Apache Derby 作为嵌入式数据库。由于 Derby 数据库默认未设置访问控制，攻击者可以未经授权地访问特定接口，执行任意 SQL 语句，最终导致远程命令执行漏洞。 漏洞原理： 1. 未授权访问： 在默认配置下，Nacos 的 Derby 数据库接口未设置访问控制，允许任何人访问。 2. SQL 注入： 攻击者通过特定的 HTTP 请求，向 Nacos 的 Der...
mirth-connect-security-poc
PoCs de vulnerabilidades de NextGen Connect 4.5.2 Exploits de prueba de concepto funcionales para tres vulnerabilidades alcanzables por red en NextGen Connect Mirth Connect 4.5.2. Los arneses ejecutan la imagen de contenedor oficial, crean únicamente la configuración de canal necesaria para el...
Astra Linux – Vulnerability in Derby
A cleverly designed username can bypass LDAP authentication checks. In LDAP-authenticated Derby installations, this could allow an attacker to create unnecessary Derby databases, thereby filling up storage space. In LDAP-authenticated Derby installations, the attacker could also execute malware...
ROOT-APP-MAVEN-CVE-2022-46337 CVE-2022-46337 in io.root.org.apache.derby:derby - Patched by Root
Root has patched CVE-2022-46337 in the io.root.org.apache.derby:derby package for Root:Maven. Multiple fixed versions available...
ROOT-APP-MAVEN-CVE-2018-1313 CVE-2018-1313 in io.root.org.apache.derby:derby - Patched by Root
Root has patched CVE-2018-1313 in the io.root.org.apache.derby:derby package for Root:Maven. Multiple fixed versions available...
Unity Linux 20.1050e / 20.1060e / 20.1070-8ae / 20.1070e Security Update: derby (UTSA-2026-016640)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-016640 advisory. In Apache Derby 10.3.1.4 to 10.14.1.0, a specially-crafted network packet can be used to request the Derby Network Server to boot a database whose location and...
Security Bulletin: Multiple vulnerabilties affects IBM DB2 Data Management Console
Summary sshd-common-2.10.0.jar, dompurify-2.2.7.tgz, derby-10.16.1.1.jar, ion-java-1.2.0.jar dependency packages are being used by IBM Db2 Data Management Console. This bulletin describes the upgrades necessary to address the vulnerability. Vulnerability Details CVEID:CVE-2024-41909 DESCRIPTION:...
CVE-2025-65951
CVE-2025-65951 affects Inside Track / Entropy Derby. Before commit 2d38d2f , the VDF-based timelock encryption did not enforce sequential delay against the betting operator, enabling bettors to pre-compute the Wesolowski VDF and include the output in encrypted bets. This allowed the house to decr...
CVE-2025-65951 Inside Track / Entropy Derby Timelock Encryption Bypassed via Pre-Computed VDF Output Leakage
Inside Track / Entropy Derby is a research-grade horse-racing betting engine. Prior to commit 2d38d2f, the VDF-based timelock encryption system fails to enforce sequential delay against the betting operator. Bettors pre-compute the entire Wesolowski VDF and include vdfOutputHex in their encrypted...
Security Bulletin: Due to the use of derby IBM webMethods BPM is vulnerable to unauthorized LDAP authentication
Summary IBM webMethods BPM is using derby which is affected by a known vulnerability CVE-2022-46337. This security bulletin provides guidance on addressing the vulnerability. Vulnerability Details CVEID:CVE-2022-46337 DESCRIPTION: A cleverly devised username might bypass LDAP authentication check...
EUVD-2006-7195
Malware in sbrugna...
EUVD-2022-5308
Malicious code in bioql PyPI...
EUVD-2022-2274
Malicious code in bioql PyPI...
EUVD-2022-5206
Malicious code in bioql PyPI...
EUVD-2023-3026
Malicious code in bioql PyPI...