Most recent entries from all https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 20 Oct 2026 17:35:05 +0000 CVE-2025-10703 https://cve.radiocsirt.org/vuln/cve-2025-10703 <p><strong>Affected:</strong> Progress DataDirect Connect for JDBC for Amazon Redshift, Progress DataDirect Connect for JDBC for Apache Cassandra, Progress DataDirect Connect for JDBC for Hive, Progress DataDirect Connect for JDBC for Apache Impala, Progress DataDirect Connect for JDBC for Apache SparkSQL, Progress DataDirect Connect for JDBC Autonomous REST Connector, Progress DataDirect Connect for JDBC for DB2, Progress DataDirect Connect for JDBC for Google Analytics 4, Progress DataDirect Connect for JDBC for Google BigQuery, Progress DataDirect Connect for JDBC for Greenplum and 22 more</p> <p>Improper Control of Generation of Code (&#39;Code Injection&#39;) vulnerability in Progress DataDirect Connect for JDBC drivers, Progress DataDirect Open Access JDBC driver and Hybrid Data Pipeline allows Remote Code Inclusion.</p> <p>The SpyAttribute connection option implemented by the DataDirect Connect for JDBC drivers, DataDirect Hybrid Data Pipeline JDBC driver and the DataDirect OpenAccess JDBC driver log=(file) construct allows the user to specify an arbitrary file for the JDBC driver to write its log information to.  If an application allows an end user to specify a value for the SpyAttributes connection option then an attacker could cause java script to be written to a log file.  If the log file was in the correct location with the correct extension, an application server could see that log file as a resource to be served.  The attacker could fetch the resource from the server causing the java script to be executed.</p> <p>This issue affects:</p> <p>DataDirect Connect for JDBC for Amazon Redshift: through 6.0.0.001392, fixed in 6.0.0.001541</p> <p>DataDirect Connect for JDBC for Apache Cassandra: through 6.0.0.000805, fixed in 6.0.0.000833</p> <p>DataDirect Connect for JDBC for Hive: through 6.0.1.001499, fixed in 6.0.1.001628</p> <p>DataDirect Connect for JDBC for Apache Impala: through 6.0.0.001155, fixed in 6.0.0.001279</p> <p>DataDirect Connect for JDBC for Apache SparkSQL: through 6.0.1.001222, fixed in 6.0.1.001344</p> <p>DataDirect Connect for JDBC Autonomous REST Connector: through 6.0.1.006961, fixed in 6…</p> <p><strong>Affected:</strong> Progress DataDirect Connect for JDBC for Amazon Redshift, Progress DataDirect Connect for JDBC for Apache Cassandra, Progress DataDirect Connect for JDBC for Hive, Progress DataDirect Connect for JDBC for Apache Impala, Progress DataDirect Connect for JDBC for Apache SparkSQL, Progress DataDirect Connect for JDBC Autonomous REST Connector, Progress DataDirect Connect for JDBC for DB2, Progress DataDirect Connect for JDBC for Google Analytics 4, Progress DataDirect Connect for JDBC for Google BigQuery, Progress DataDirect Connect for JDBC for Greenplum and 22 more</p> <p>Improper Control of Generation of Code (&#39;Code Injection&#39;) vulnerability in Progress DataDirect Connect for JDBC drivers, Progress DataDirect Open Access JDBC driver and Hybrid Data Pipeline allows Remote Code Inclusion.</p> <p>The SpyAttribute connection option implemented by the DataDirect Connect for JDBC drivers, DataDirect Hybrid Data Pipeline JDBC driver and the DataDirect OpenAccess JDBC driver log=(file) construct allows the user to specify an arbitrary file for the JDBC driver to write its log information to.  If an application allows an end user to specify a value for the SpyAttributes connection option then an attacker could cause java script to be written to a log file.  If the log file was in the correct location with the correct extension, an application server could see that log file as a resource to be served.  The attacker could fetch the resource from the server causing the java script to be executed.</p> <p>This issue affects:</p> <p>DataDirect Connect for JDBC for Amazon Redshift: through 6.0.0.001392, fixed in 6.0.0.001541</p> <p>DataDirect Connect for JDBC for Apache Cassandra: through 6.0.0.000805, fixed in 6.0.0.000833</p> <p>DataDirect Connect for JDBC for Hive: through 6.0.1.001499, fixed in 6.0.1.001628</p> <p>DataDirect Connect for JDBC for Apache Impala: through 6.0.0.001155, fixed in 6.0.0.001279</p> <p>DataDirect Connect for JDBC for Apache SparkSQL: through 6.0.1.001222, fixed in 6.0.1.001344</p> <p>DataDirect Connect for JDBC Autonomous REST Connector: through 6.0.1.006961, fixed in 6…</p> https://cve.radiocsirt.org/vuln/cve-2025-10703