106 matches found
CVE-2019-12384
CVE-2019-12384 Jackson RCE And SSRF 0x01 python -m SimpleHTTPServer root@kitploit: python -m SimpleHTTPServer Serving HTTP on 0.0.0.0 port 8000 ... 127.0.0.1 - - 24/Jul/2019 03:06:32 "GET /inject.sql HTTP/1.1" 200 - inject.sql root@kitploit: CREATE ALIAS SHELLEXEC AS $$ String shellexecString cmd...
CVE-2022-41828
CVE-2022-41828 Amazon AWS Redshift JDBC 드라이버 원격 코드 실행 RCE Amazon JDBC Driver for Redshift는 Java Platform, Enterprise Editions에서 제공하는 표준 JDBC 애플리케이션 프로그래밍 인터페이스API를 통해 데이터베이스 연결을 제공하는 Type 4 JDBC 드라이버입니다. 이 드라이버는 모든 Java 애플리케이션, 애플리케이션 서버 또는 Java 지원 애플릿에서 Redshift에 접근할 수 있도록 합니다. redshift-jdbc42 버...
H2-database-CVE-2022-23221
H2 Database RCE CVE-2022-23221 1. 요약 참고: https://nvd.nist.gov/vuln/detail/cve-2022-23221 H2는 관계형 데이터베이스 관리 시스템으로, SQL 엔진 안에서 Java 코드를 직접 컴파일하고 실행할 수 있는 기능을 제공한다. H2 드라이버는 JDBC URL을 파싱하여 애플리케이션과 데이터베이스 간의 연결을 설정한다. 이때 URL에 포함된 설정 파라미터를 통해 데이터베이스의 초기 상태나 동작을 제어할 수 있다. 문제가 되는 H2 2.1.210 이전 버전에는 JDBC...
CVE-2026-75431_PowerJob_jwt_key_predictable
PowerJob JWT 签名密钥可预测（密钥由默认 JDBC URL 派生）→ 令牌伪造 1. 概述 PowerJob Server 的 JWT（HS256）签名密钥是通过对硬编码常量与默认 JDBC URL 的 MD5 拼接结果进行 BASE64 解码 而派生的（DefaultSecretProvider / JwtServiceImpl）。在默认部署（docker-compose / application-daily.properties）中，JDBC URL 是公开的，因此攻击者可以完全离线推导出密钥 ，并为任何用户（包括管理员）伪造有效的 JWT；OpenAPI...
CVE-2025-70828
CVE-2025-70828 概要 Datart v1.0.0-rc.3 に任意のファイル読み取りの脆弱性が発見されました。このアプリケーションは、データソース設定時に JDBC 接続 URL を適切に検証しません。 脆弱性の詳細 脆弱性タイプ: 不適切な入力検証 CWE-20 / 任意のファイル読み取り 影響を受けるバージョン: Datart v1.0.0-rc.3 深刻度: 高 機密情報が漏えいする可能性 説明 この脆弱性は、データソース設定モジュールに存在します。アプリケーションは JDBC 設定内の url...
Security Bulletin: IBM® Data Server driver for JDBC and SQLJ is vulnerable to remote code execution when jdbc url is under user control (CVE-2026-9762)
Summary IBM® Db2® is vulnerable to remote code execution when jdbc url is under user control. Vulnerability Details CVEID:CVE-2026-9762 DESCRIPTION: IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 is vulnerable to remote code execution when jdbc url is under user control. CWE:CWE-94:...
CVE-2026-42537
Apache Ranger suffers Remote Code Execution via JDBC URL Injection in versions
EUVD-2026-55251
Remote Code Execution via JDBC URL Injection in Apache Ranger = 2.8.0 Users are recommended to upgrade to version 2.9.0, which fixes this issue...
IBM DB2 Remote Code Execution (7279479) (Unix)
According to its self-reported version number, IBM Db2 is affected by a remote code execution vulnerability: - IBM Data Server Driver for JDBC and SQLJ is vulnerable to remote code execution when jdbc url is under user control. CVE-2026-9762 Note that Nessus has not tested for this issue but has...
CVE-2026-9762 IBM® Data Server driver for JDBC and SQLJ is vulnerable to remote code execution when jdbc url is under user control
IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 is vulnerable to remote code execution when jdbc url is under user control...
CVE-2026-9762 IBM® Data Server driver for JDBC and SQLJ is vulnerable to remote code execution when jdbc url is under user control
IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 is vulnerable to remote code execution when jdbc url is under user control...
CVE-2026-53751 DataEase: H2 JDBC URL Filter Bypass Leads to Remote Code Execution (RCE)
DataEase is an open source data visualization and analysis tool. Prior to 2.10.24, the H2 database JDBC URL validation logic can be bypassed with special Unicode characters whose case-conversion behavior differs between DataEase validation and H2 parsing, allowing attackers to smuggle dangerous...
CVE-2026-12787
A vulnerability was found in zhilink 智互联深圳科技有限公司 ADP Application Developer Platform 应用开发者平台 1.0.0. This affects an unknown part of the component testConnection Endpoint. The manipulation of the argument jdbcUrl results in deserialization. The attack may be performed from remote. The exploit has...
EUVD-2026-38151
A vulnerability was found in zhilink 智互联深圳科技有限公司 ADP Application Developer Platform 应用开发者平台 1.0.0. This affects an unknown part of the component testConnection Endpoint. The manipulation of the argument jdbcUrl results in deserialization. The attack may be performed from remote. The exploit has...
Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')
Overview Affected versions of this package are vulnerable to Use of Externally-Controlled Input to Select Classes or Code 'Unsafe Reflection' via the processing of JDBC connection URL parameters. An attacker can execute arbitrary code by supplying a crafted connection URL that causes the loading...
CVE-2026-32939
DataEase is an open source data visualization analysis tool. Versions 2.10.19 and below have inconsistent Locale handling between the JDBC URL validation logic and the H2 JDBC engine's internal parsing. DataEase uses String.toUpperCase without specifying an explicit Locale, causing its security...
CVE-2025-13268
A flaw has been found in Dromara dataCompare up to 1.0.1. The affected element is the function DbConfig of the file src/main/java/com/vince/xq/project/system/dbconfig/service/DbconfigServiceImpl.java of the component JDBC URL Handler. Executing manipulation can lead to injection. The attack can b...
CVE-2025-13268 Dromara dataCompare JDBC URL DbconfigServiceImpl.java DbConfig injection
A flaw has been found in Dromara dataCompare up to 1.0.1. The affected element is the function DbConfig of the file src/main/java/com/vince/xq/project/system/dbconfig/service/DbconfigServiceImpl.java of the component JDBC URL Handler. Executing manipulation can lead to injection. The attack can b...