Apache Derby exposes user and password attributes

Description

References

• nvd.nist.gov/vuln/detail/CVE-2005-4849 · ADVISORY
• apache/derby commit 09a7325 · WEB
• apache/derby commit 82d721f · WEB
• apache/derby commit fd24a75 · WEB
• apache/derby · PACKAGE
• db.apache.org/derby/releases/release-10.1.2.1.html · WEB
• issues.apache.org/jira/browse/DERBY-530 · WEB
• issues.apache.org/jira/browse/DERBY-559 · WEB
• svn.apache.org/viewvc · WEB

Autres vulnérabilités de org.apache.derby:derby

• CVE-2022-46337CRITIQUE 9.8A cleverly devised username might bypass LDAP authentication checks. In LDAP-authenticated Derby installations, this could let an attacker …
• CVE-2018-1313MOYENNE 5.3In Apache Derby 10.3.1.4 to 10.14.1.0, a specially-crafted network packet can be used to request the Derby Network Server to boot a database…
• CVE-2010-2232ÉLEVÉE 7.5In Apache Derby 10.1.2.1, 10.2.2.0, 10.3.1.4, and 10.4.1.3, Export processing may allow an attacker to overwrite an existing file.
• CVE-2015-1832CRITIQUE 9.1XML external entity (XXE) vulnerability in the SqlXmlUtil code in Apache Derby before 10.12.1.1, when a Java Security Manager is not in plac…
• CVE-2009-4269FAIBLE 2.1The password hash generation algorithm in the BUILTIN authentication functionality for Apache Derby before 10.6.1.0 performs a transformatio…