CVE-2024-47074

DataEase prior to version 1.18.25 is affected. The root cause is the PgConfiguration class in JdbcProvider that does not filter JDBC URL parameters and directly concatenates user input, allowing an attacker to append parameters and connect to a malicious PostgreSQL server. This enables triggering...

CVE-2024-47074 Dataease PostgreSQL Data Source JDBC Connection Parameters Not Verified Leads to Deserialization Vulnerability

DataEase is an open source data visualization analysis tool. In Dataease, the PostgreSQL data source in the data source function can customize the JDBC connection parameters and the PG server target to be connected. In backend/src/main/java/io/dataease/provider/datasource/JdbcProvider.java,...

CVE-2024-47074 Dataease PostgreSQL Data Source JDBC Connection Parameters Not Verified Leads to Deserialization Vulnerability

DataEase is an open source data visualization analysis tool. In Dataease, the PostgreSQL data source in the data source function can customize the JDBC connection parameters and the PG server target to be connected. In backend/src/main/java/io/dataease/provider/datasource/JdbcProvider.java,...

How to Update NATS and PostgreSQL Passwords Used by Veeam Backup for Microsoft 365

Purpose This article documents the procedures for updating the password Veeam Backup for Microsoft 365 uses to connect to the NATS server and the configuration database. Solution Expand the section below relevant to the password that has been changed: How to Update NATS Server Password Default...

DataEase 代码问题漏洞

DataEase is an open source data visualization and analysis tool from DataEase Open Source. Used to help users quickly analyze data and insight into business trends , so as to achieve business improvement and optimization . A code issue vulnerability exists in versions prior to DataEase v1.18.25...

CentOS 7 : postgresql (RHSA-2021:2397)

The remote CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2021:2397 advisory. - A flaw was found in postgresql in versions before 13.3, before 12.7, before 11.12, before 10.17 and before 9.6.22. While modifying certain SQL array values,...

[SECURITY] Fedora 41 Update: pgadmin4-8.12-1.fc41

pgAdmin is the most popular and feature rich Open Source administration and d evelopment platform for PostgreSQL, the most advanced Open Source database in the world...

PostgreSQL pgAdmin4 Installed (macOS)

Binary data postgresqlpgadmin4macosinstalled.nbin...

PostgreSQL pgAdmin4 Installed (Windows)

Binary data postgresqlpgadmin4wininstalled.nbin...

Exploit for OS Command Injection in Postgresql

EN GenPostgresRCEExploit is a PoC tool designed to exploit...

Exploit for OS Command Injection in Postgresql

EN GenPostgresRCEExploit is a PoC tool designed to exploit...

[SECURITY] Fedora 40 Update: pgadmin4-8.9-3.fc40

pgAdmin is the most popular and feature rich Open Source administration and d evelopment platform for PostgreSQL, the most advanced Open Source database in the world...

Acronis Cyber Infrastructure 5.0.1-61 Cross Site Request Forgery

============================================================================================================================================= | Title : Acronis Cyber Infrastructure 5.0.1-61 CSRF Add ADmin Vulnerability | | Author : indoushka | | Tested on : windows 10 FrPro / browser : Mozilla...

Advisory ROSA-SA-2024-2501

Software: postgresql 12.20 OS: ROSA Virtualization 2.1 packageevrstring: postgresql-12.20-1.rv3 CVE-ID: CVE-2021-32027 BDU-ID: 2021-02776 CVE-Crit: HIGH CVE-DESC.: A vulnerability in the PostgreSQL database management system is related to an operation exceeding buffer boundaries during array...

Advisory ROSA-SA-2024-2484

Software: postgresql13 13.15 OS: rosa-server79 packageevrstring: postgresql13-13.15-1PGDG.res7 CVE-ID: CVE-2022-41862 BDU-ID: 2023-02003 CVE-Crit: LOW CVE-DESC.: A vulnerability in the PostgreSQL database management system is related to information disclosure. Exploitation of the vulnerability...

GHSA-78P3-FWCQ-62C2 @saltcorn/server Remote Code Execution (RCE) / SQL injection via prototype pollution by manipulating `lang` and `defstring` parameters when setting localizer strings

Summary The endpoint /site-structure/localizer/save-string/:lang/:defstring accepts two parameter values: lang and defstring. These values are used in an unsafe way to set the keys and value of the cfgStrings object. It allows to add/modify properties of the Object prototype that result in severa...

Acronis Cyber Infrastructure Default Password Remote Code Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'sshkey' class MetasploitModule 'Acronis Cyber Infrastructure default password remote code execution', 'Description' = %q Acronis Cyber Infrastructure ACI is an ...

Acronis Cyber Infrastructure Default Password Remote Code Execution Exploit

Acronis Cyber Infrastructure ACI is an IT infrastructure solution that provides storage, compute, and network resources. Businesses and Service Providers are using it for data storage, backup storage, creating and managing virtual machines and software-defined networks, running cloud-native...

Security update for postgresql16

This update for postgresql16 fixes the following issues: Upgrade to 15.8 bsc1229013 CVE-2024-7348: PostgreSQL relation replacement during pgdump executes arbitrary SQL. bsc1229013 Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate ...

Important: postgresql

Issue Overview: Time-of-check Time-of-use TOCTOU race condition in pgdump in PostgreSQL allows an object creator to execute arbitrary SQL functions as the user running pgdump, which is often a superuser. The attack involves replacing another relation type with a view or foreign table. The attack...