Security Bulletin: IBM InfoSphere Information Server is affected by multiple vulnerabilities in the JDBC driver for Apache Hive

Summary Multiple vulnerabilities in the JDBC driver for Apache Hive that is used by InfoSphere Information Server were addressed. Vulnerability Details CVEID:CVE-2025-58163 DESCRIPTION: FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Versions 1.8.185 and earlier...

EUVD-2018-0758

Malware in sbrugna...

EUVD-2024-1812

Malicious code in bioql PyPI...

CVE-2024-45199

insightsoftware Hive JDBC through 2.6.13 has a remote code execution vulnerability. Attackers can inject malicious parameters into the JDBC URL, triggering JNDI injection during the process when the JDBC Driver uses this URL to connect to the database. This can further lead to remote code executi...

CVE-2024-45199

The insightsoftware Hive JDBC driver (versions through 2.6.13 ) is vulnerable to Remote Code Execution (RCE) due to a JNDI injection flaw. Attackers can exploit this by injecting malicious parameters into the JDBC URL when the driver attempts to connect to a database. This vulnerability is catego...

CVE-2024-45199

insightsoftware Hive JDBC through 2.6.13 has a remote code execution vulnerability. Attackers can inject malicious parameters into the JDBC URL, triggering JNDI injection during the process when the JDBC Driver uses this URL to connect to the database. This can further lead to remote code executi...

CVE-2024-45199

insightsoftware Hive JDBC through 2.6.13 has a remote code execution vulnerability. Attackers can inject malicious parameters into the JDBC URL, triggering JNDI injection during the process when the JDBC Driver uses this URL to connect to the database. This can further lead to remote code executi...

PT-2025-14799

Name of the Vulnerable Software and Affected Versions insightsoftware Hive JDBC versions prior to 2.6.14 Description The issue allows for remote code execution via JNDI injection. Attackers can inject malicious parameters into the JDBC URL, triggering JNDI injection during the process when the JD...

CVE-2024-45199: Improper Control of Generation of Code

insightsoftware Hive JDBC through 2.6.13 has a remote code execution vulnerability. Attackers can inject malicious parameters into the JDBC URL, triggering JNDI injection during the process when the JDBC Driver uses this URL to connect to the database. This can further lead to remote code executi...

org.apache.hive.hcatalog:hive-webhcat (>=4.0.0-alpha-1, <=4.0.0-beta-1), org.apache.hive:hive-beeline (>=4.0.0-alpha-1, <=4.0.0-alpha-2) +2 more potentially affected by CVE-2023-35701 via org.apache.hive:hive-jdbc (>=4.0.0-alpha-1, <=4.0.0-beta-1)

org.apache.hive:hive-jdbc MAVEN version =4.0.0-alpha-1, =4.0.0-alpha-1, =4.0.0-alpha-1, =4.0.0-alpha-1, =4.0.0-beta-1 - org.apache.hop:hop-databases-hive 2.2.0 Source cves: CVE-2023-35701 Source advisory: OSV:GHSA-VPW3-3PRF-3974...

org.apache.hive.hcatalog:hive-webhcat (>=4.0.0-alpha-1, <=4.0.0-beta-1), org.apache.hive:hive-beeline (>=4.0.0-alpha-1, <=4.0.0-alpha-2) +2 more potentially affected by CVE-2023-35701 via org.apache.hive:hive-jdbc (>=4.0.0-alpha-1, <=4.0.0-beta-1)

org.apache.hive:hive-jdbc MAVEN version =4.0.0-alpha-1, =4.0.0-alpha-1, =4.0.0-alpha-1, =4.0.0-alpha-1, =4.0.0-beta-1 - org.apache.hop:hop-databases-hive 2.2.0 Source cves: CVE-2023-35701 Source advisory: GHSA-VPW3-3PRF-3974...

org.apache.hive.hcatalog:hive-webhcat (>=4.0.0-alpha-1, <=4.0.0-beta-1), org.apache.hive:hive-beeline (>=4.0.0-alpha-1, <=4.0.0-alpha-2) +2 more potentially affected by CVE-2023-35701 via org.apache.hive:hive-jdbc (>=4.0.0-alpha-1, <=4.0.0-beta-1)

org.apache.hive:hive-jdbc MAVEN version =4.0.0-alpha-1, =4.0.0-alpha-1, =4.0.0-alpha-1, =4.0.0-alpha-1, =4.0.0-beta-1 - org.apache.hop:hop-databases-hive 2.2.0 Source cves: CVE-2023-35701 Source advisory: MEND:CVE-2023-35701...

CVE-2023-35701: Improper Control of Generation of Code

Improper Control of Generation of Code 'Code Injection' vulnerability in Apache Hive. The vulnerability affects the Hive JDBC driver component and it can potentially lead to arbitrary code execution on the machine/endpoint that the JDBC driver client is running. The malicious user must have...

org.apache.hive:hive-beeline (1.0.0), org.apache.hive:hive-jdbc (1.0.0) potentially affected by CVE-2015-1772 via org.apache.hive:hive-service (1.0.0)

org.apache.hive:hive-service MAVEN version 1.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.hive:hive-service and may be impacted: - org.apache.hive:hive-beeline 1.0.0 - org.apache.hive:hive-jdbc 1.0.0 Source cves: CVE-2015-1772 Source...

org.apache.hive:hive-cli (0.8.1), org.apache.hive:hive-hwi (0.8.1) +1 more potentially affected by CVE-2016-3083 via org.apache.hive:hive-service (0.8.1)

org.apache.hive:hive-service MAVEN version 0.8.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.hive:hive-service and may be impacted: - org.apache.hive:hive-cli 0.8.1 - org.apache.hive:hive-hwi 0.8.1 - org.apache.hive:hive-jdbc 0.8.1 Sourc...

org.apache.hive:hive-cli (0.8.1), org.apache.hive:hive-contrib (0.8.1) +4 more potentially affected by CVE-2018-11777 via org.apache.hive:hive-exec (0.8.1)

org.apache.hive:hive-exec MAVEN version 0.8.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.hive:hive-exec and may be impacted: - org.apache.hive:hive-cli 0.8.1 - org.apache.hive:hive-contrib 0.8.1 - org.apache.hive:hive-hbase-handler 0.8....

com.nflabs.zeppelin:zeppelin-cli (>=0.1.0, <=0.1.2), com.nflabs.zeppelin:zeppelin-server (>=0.1.0, <=0.1.2) +1 more potentially affected by CVE-2018-1314 via org.apache.hive:hive-jdbc (0.9.0)

org.apache.hive:hive-jdbc MAVEN version 0.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.hive:hive-jdbc and may be impacted: - com.nflabs.zeppelin:zeppelin-cli =0.1.0, =0.1.0, =0.1.0, =0.1.2 Source cves: CVE-2018-1314 Source advisory:...

com.nflabs.zeppelin:zeppelin-cli (0.2.0), com.nflabs.zeppelin:zeppelin-distribution (>=0.2.0, <=0.3.3) +3 more potentially affected by CVE-2018-1314 via org.apache.hive:hive-jdbc (0.11.0)

org.apache.hive:hive-jdbc MAVEN version 0.11.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.hive:hive-jdbc and may be impacted: - com.nflabs.zeppelin:zeppelin-cli 0.2.0 - com.nflabs.zeppelin:zeppelin-distribution =0.2.0, =0.3.0, =0.3.3 -...

com.thinkbiganalytics.kylo:kylo-kerberos-test-client (>=0.8.3, <=0.9.1), org.apache.hive:hive-beeline (0.14.0) +1 more potentially affected by CVE-2018-1314 via org.apache.hive:hive-jdbc (0.14.0)

org.apache.hive:hive-jdbc MAVEN version 0.14.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.hive:hive-jdbc and may be impacted: - com.thinkbiganalytics.kylo:kylo-kerberos-test-client =0.8.3, =0.9.1 - org.apache.hive:hive-beeline 0.14.0 -...

org.apache.hive:hive-beeline (1.0.0) potentially affected by CVE-2018-1314 via org.apache.hive:hive-jdbc (1.0.0)

org.apache.hive:hive-jdbc MAVEN version 1.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.hive:hive-jdbc and may be impacted: - org.apache.hive:hive-beeline 1.0.0 Source cves: CVE-2018-1314 Source advisory: OSV:GHSA-JMF4-PQ78-F8VJ...