SUSE-SU-2022:3537-1 Security update for postgresql-jdbc

This update for postgresql-jdbc fixes the following issues: - CVE-2022-31197: Fixed SQL injection vulnerability bsc1202170...

Arbitrary File Write

postgresql-jdbc is vulnerable to arbitrary file writes. The vulnerability exists because the connection properties for configuring a pgjdbc connection are exposed which allows an attacker to specify arbitrary connection properties could lead to a compromise of a system...

postgresql-jdbc: Arbitrary File Write Vulnerability

A flaw was found in Postgres JDBC. This flaw allows an attacker to use a method to write arbitrary files through the connection properties settings. For example, an attacker can create an executable file under the server the application is running and make it a new part of the application or serv...

[SECURITY] Fedora 36 Update: postgresql-jdbc-42.3.1-4.fc36

PostgreSQL is an advanced Object-Relational database management system. The postgresql-jdbc package includes the .jar files needed for Java programs to access a PostgreSQL database...

Fedora: Security Advisory for postgresql-jdbc (FEDORA-2022-cdeabe1bc0)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Fedora: Security Advisory for postgresql-jdbc (FEDORA-2022-d7d49b2fac)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Duplicate Advisory: AWS Redshift JDBC Driver fails to validate class type during object instantiation

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-jc69-hjw2-fm86. This link is maintained to preserve external references. Original Description In Amazon AWS Redshift JDBC Driver aka amazon-redshift-jdbc-driver or redshift-jdbc42 before 2.1.0.8, the Object...

CVE-2022-41828

In Amazon AWS Redshift JDBC Driver aka amazon-redshift-jdbc-driver or redshift-jdbc42 before 2.1.0.8, the Object Factory does not check the class type when instantiating an object from a class name...

Design/Logic Flaw

In Amazon AWS Redshift JDBC Driver aka amazon-redshift-jdbc-driver or redshift-jdbc42 before 2.1.0.8, the Object Factory does not check the class type when instantiating an object from a class name...

CVE-2022-41828

Summary: CVE-2022-41828 concerns the Amazon AWS Redshift JDBC Driver (redshift-jdbc42) prior to 2.1.0.8, where the Object Factory does not validate the target class type before instantiation, enabling potential remote code execution via crafted class names. Connected documents show concrete detai...

PT-2022-26085 · Amazon · Amazon Redshift Jdbc Driver

Name of the Vulnerable Software and Affected Versions: Amazon AWS Redshift JDBC Driver versions prior to 2.1.0.8 Description: The Object Factory in the Amazon AWS Redshift JDBC Driver does not check the class type when instantiating an object from a class name. This issue can lead to a potential...

CVE-2022-41828

In Amazon AWS Redshift JDBC Driver aka amazon-redshift-jdbc-driver or redshift-jdbc42 before 2.1.0.8, the Object Factory does not check the class type when instantiating an object from a class name...

CVE-2022-41828

In Amazon AWS Redshift JDBC Driver aka amazon-redshift-jdbc-driver or redshift-jdbc42 before 2.1.0.8, the Object Factory does not check the class type when instantiating an object from a class name...

CVE-2022-41828

In Amazon AWS Redshift JDBC Driver aka amazon-redshift-jdbc-driver or redshift-jdbc42 before 2.1.0.8, the Object Factory does not check the class type when instantiating an object from a class name...

Security Bulletin: Informix JDBC Java API Documentation Frame Injection Vulnerability (CVE-2013-1571)

Abstract Java API Documentation contains a frame injection vulnerability. Content CVEID: CVE-2013-1571 DESCRIPTION: HTML documentation generated by the Javadoc tool contains a security vulnerability. The vulnerability allows an attacker to craft a malicious link to the documentation which injects...

OESA-2022-1956 log4j security update

Log4j is a tool to help the programmer output log statements to a variety of output targets. Security Fixes: Apache Log4j2 versions 2.0-alpha1 through 2.16.0 excluding 2.12.3 and 2.3.1 did not protect from uncontrolled recursion from self-referential lookups. This allows an attacker with control...

Remote Code Execution

org.apache.inlong:sort-connector-jdbc is vulnerable to remote code execution. A remote attacker with sufficient privileges to specify MySQL JDBC connection URL parameters and to write arbitrary data to the MySQL database is able to upload and execute malicious code on server by misusing data...

Spring Session 2022.0.0-M3 Released

On behalf of the team, I’m pleased to announce the release of Spring Session 2022.0.0-M3. These releases deliver, enhancements, bug fixes, and dependency upgrades. For your convenience, Spring Boot will pick up these artifacts with its upcoming releases. The following modules were updated as part...

CVE-2022-40955

In versions of Apache InLong prior to 1.3.0, an attacker with sufficient privileges to specify MySQL JDBC connection URL parameters and to write arbitrary data to the MySQL database, could cause this data to be deserialized by Apache InLong, potentially leading to Remote Code Execution on the...

Remote code execution

In versions of Apache InLong prior to 1.3.0, an attacker with sufficient privileges to specify MySQL JDBC connection URL parameters and to write arbitrary data to the MySQL database, could cause this data to be deserialized by Apache InLong, potentially leading to Remote Code Execution on the...