https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 09 Oct 2026 20:47:53 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-240514 EUVD-2026-240514 https://cve.radiocsirt.org/vuln/euvd-2026-240514 https://cve.radiocsirt.org/vuln/fkie_cve-2022-41828 <p>In Amazon AWS Redshift JDBC Driver (aka amazon-redshift-jdbc-driver or redshift-jdbc42) before 2.1.0.8, the Object Factory does not check the class type when instantiating an object from a class name.</p> <p>In Amazon AWS Redshift JDBC Driver (aka amazon-redshift-jdbc-driver or redshift-jdbc42) before 2.1.0.8, the Object Factory does not check the class type when instantiating an object from a class name.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2022-41828 https://cve.radiocsirt.org/vuln/ghsa-jc69-hjw2-fm86 <p><strong>Affected:</strong> Maven: com.amazon.redshift:redshift-jdbc42</p> <p>### Impact</p> <p>A potential remote command execution issue exists within `redshift-jdbc42` versions 2.1.0.7 and below. When plugins are used with the driver, it instantiates plugin instances based on Java class names provided via the `sslhostnameverifier`, `socketFactory`, `sslfactory`, and `sslpasswordcallback` connection properties. In affected versions, the driver does not verify if a plugin class implements the expected interface before instantiatiaton. This can lead to loading of arbitrary Java classes, which a knowledgeable attacker with control over the JDBC URL can use to achieve remote code execution.</p> <p>### Patches</p> <p>This issue is patched within `redshift-jdbc-42` 2.1.0.8 and above.</p> <p>### Workarounds</p> <p>We advise customers using plugins to upgrade to `redshift-jdbc42` version 2.1.0.8 or above. There are no known workarounds for this issue.</p> <p>### For more information</p> <p>If you have any questions or comments about this advisory, please contact AWS Security at [aws-security@amazon.com](mailto:aws-security@amazon.com).</p> <p><strong>Affected:</strong> Maven: com.amazon.redshift:redshift-jdbc42</p> <p>### Impact</p> <p>A potential remote command execution issue exists within `redshift-jdbc42` versions 2.1.0.7 and below. When plugins are used with the driver, it instantiates plugin instances based on Java class names provided via the `sslhostnameverifier`, `socketFactory`, `sslfactory`, and `sslpasswordcallback` connection properties. In affected versions, the driver does not verify if a plugin class implements the expected interface before instantiatiaton. This can lead to loading of arbitrary Java classes, which a knowledgeable attacker with control over the JDBC URL can use to achieve remote code execution.</p> <p>### Patches</p> <p>This issue is patched within `redshift-jdbc-42` 2.1.0.8 and above.</p> <p>### Workarounds</p> <p>We advise customers using plugins to upgrade to `redshift-jdbc42` version 2.1.0.8 or above. There are no known workarounds for this issue.</p> <p>### For more information</p> <p>If you have any questions or comments about this advisory, please contact AWS Security at [aws-security@amazon.com](mailto:aws-security@amazon.com).</p> https://cve.radiocsirt.org/vuln/ghsa-jc69-hjw2-fm86 https://cve.radiocsirt.org/vuln/gsd-2022-41828 gsd-2022-41828 https://cve.radiocsirt.org/vuln/gsd-2022-41828 https://cve.radiocsirt.org/vuln/wid-sec-w-2023-0412 <p>Ein entfernter, anonymer Angreifer kann eine Schwachstelle in IBM Security Guardium ausnutzen, um Sicherheitsvorkehrungen zu umgehen.</p> <p>Ein entfernter, anonymer Angreifer kann eine Schwachstelle in IBM Security Guardium ausnutzen, um Sicherheitsvorkehrungen zu umgehen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2023-0412