CVE-2018-12023

An issue was discovered in FasterXML jackson-databind prior to 2.7.9.4, 2.8.11.2, and 2.9.6. When Default Typing is enabled either globally or for a specific property, the service has the Oracle JDBC jar in the classpath, and an attacker can provide an LDAP service to access, it is possible to ma...

org.apache.hive:hive-beeline (=1.0.0), org.apache.hive:hive-jdbc (=1.0.0) potentially affected by CVE-2015-1772 via org.apache.hive:hive-service (=1.0.0)

org.apache.hive:hive-service MAVEN version =1.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.hive:hive-service and may be impacted: - org.apache.hive:hive-beeline =1.0.0 - org.apache.hive:hive-jdbc =1.0.0 Source cves: CVE-2015-1772 Sour...

org.apache.hive:hive, org.apache.hive:hive-exec, and org.apache.hive:hive-service vulnerable to Improper Certificate Validation

Apache Hive JDBC + HiveServer2 implements SSL for plain TCP and HTTP connections it supports both transport modes. While validating the server's certificate during the connection setup, the client in Apache Hive before 1.2.2 and 2.0.x before 2.0.1 doesn't seem to be verifying the common name...

Fedora 29 : postgresql-jdbc (2019-7d0d59764e)

new upstream version, to fix CVE-2018-10936 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. C...

Fedora 28 : postgresql-jdbc (2019-1b9e80874d)

new upstream version, to fix CVE-2018-10936 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. C...

Fedora Update for postgresql-jdbc FEDORA-2019-1b9e80874d

The remote host is missing an update for the Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

[SECURITY] Fedora 29 Update: postgresql-jdbc-42.2.5-2.fc29

PostgreSQL is an advanced Object-Relational database management system. The postgresql-jdbc package includes the .jar files needed for Java programs to access a PostgreSQL database...

[SECURITY] Fedora 28 Update: postgresql-jdbc-42.2.5-2.fc28

PostgreSQL is an advanced Object-Relational database management system. The postgresql-jdbc package includes the .jar files needed for Java programs to access a PostgreSQL database...

org.apache.jspwiki.it:jspwiki-it-builder (=2.11.0), org.apache.jspwiki.it:jspwiki-it-test-cma (=2.11.0) +8 more potentially affected by CVE-2018-20242 via org.apache.jspwiki:jspwiki-war (>=2.10.0 <=2.11.0)

org.apache.jspwiki:jspwiki-war MAVEN version =2.10.0, =2.10.0, =2.10.3, =2.10.5 - org.apache.jspwiki:jspwiki-portable =2.11.0 Source cves: CVE-2018-20242 Source advisory: OSV:GHSA-5Q75-CXCQ-WR26...

Authorization Bypass

ovirt-engine-extension-aaa-jdbc is vulnerable to authorization bypass attacks. The vulnerability exists when updating a password in the rhvm database the ovirt-aaa-jdbc-tool tools before 1.1.3 fail to correctly check for the current password if it is expired. This would allow access to an attacke...

IBM Integration Bus 8.x <= 8.0.0.9 / 9.x < 9.0.0.11 / 10.x < 10.0.0.12 JDBC XA switch load files Vulnerability (CVE-2017-1418)

The version of IBM Integration Bus formerly known as IBM WebSphere Message Broker installed on the remote host is 8.x prior or equal to 8.0.0.9, 9.x prior to 9.0.0.11, or 10.x prior to 10.0.0.12. It is, therefore, affected by an unspecified file permissions vulnerability. C Tenable Network...

Debian: Security Advisory (DLA-1621-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

com.ge.research.semtk:arangoDbService (=2.2.2), com.ge.research.semtk:athenaService (=2.2.2) +123 more potentially affected by CVE-2018-1314 via org.apache.hive:hive-jdbc (>=0.9.0 <=2.3.2)

org.apache.hive:hive-jdbc MAVEN version =0.9.0, =2.2.1, =2.2.1, =2.2.1, =2.2.2 - com.ge.research.semtk:sparqlGraphResultsService =2.2.2 and more Source cves: CVE-2018-1314 Source advisory: OSV:GHSA-JMF4-PQ78-F8VJ...

com.mydataharbor:jdbc-hive-3.0.x-plugin (>=1.1.1 <=2.0.2), io.hetu.core:hetu-carbondata (>=1.0.1 <=1.9.0) +10 more potentially affected by CVE-2018-1314 via org.apache.hive:hive-jdbc (>=3.0.0 <=3.1.0)

org.apache.hive:hive-jdbc MAVEN version =3.0.0, =1.1.1, =1.0.1, =2.0.0, =3.0.0, =3.0.0, =3.0.0, =0.6.0-incubating, =1.7.0, =1.7.0, =1.11.3 - org.apache.ranger:ranger-hive-plugin =2.0.0 - org.apache.ranger:ranger-hive-plugin-shim =2.0.0 Source cves: CVE-2018-1314 Source advisory:...

Moderate severity vulnerability that affects org.apache.hive:hive-jdbc

In Apache Hive 2.3.3, 3.1.0 and earlier, Hive "EXPLAIN" operation does not check for necessary authorization of involved entities in a query. An unauthorized user can do "EXPLAIN" on arbitrary table or view and expose table metadata and statistics...

GHSA-JF2M-435M-MXW8 SQL Injection in hive-jdbc

This vulnerability in Apache Hive JDBC driver 0.7.1 to 2.3.2 allows carefully crafted arguments to be used to bypass the argument escaping/cleanup that JDBC driver does in PreparedStatement implementation...

com.ge.research.semtk:arangoDbService (=2.2.2), com.ge.research.semtk:athenaService (=2.2.2) +123 more potentially affected by CVE-2018-1282 via org.apache.hive:hive-jdbc (>=0.9.0 <=2.3.2)

org.apache.hive:hive-jdbc MAVEN version =0.9.0, =2.2.1, =2.2.1, =2.2.1, =2.2.2 - com.ge.research.semtk:sparqlGraphResultsService =2.2.2 and more Source cves: CVE-2018-1282 Source advisory: OSV:GHSA-JF2M-435M-MXW8...

SQL Injection in hive-jdbc

This vulnerability in Apache Hive JDBC driver 0.7.1 to 2.3.2 allows carefully crafted arguments to be used to bypass the argument escaping/cleanup that JDBC driver does in PreparedStatement implementation...

[SECURITY] Fedora 28 Update: mysql-connector-java-8.0.13-1.fc28

MySQL Connector/J is a native Java driver that converts JDBC Java Database Connectivity calls into the network protocol used by the MySQL database. It lets developers working with the Java programming language easily build programs and applets that interact with MySQL and connect all corporate...

[SECURITY] Fedora 29 Update: mysql-connector-java-8.0.13-1.fc29

MySQL Connector/J is a native Java driver that converts JDBC Java Database Connectivity calls into the network protocol used by the MySQL database. It lets developers working with the Java programming language easily build programs and applets that interact with MySQL and connect all corporate...