org.apache.derby CVEs · No exploit published

VRT Sign in

Look up CVE IDs Status Exploitation Severity

Reset

Overview 2 matches · 0 protected · 0 exploited · 0 CISA KEV · 0 public PoC · 0 EPSS ≥ 0.5

2matches 0protected0.0% 0exploited0.0% 0CISA KEV0.0% 0public PoC0.0% 0EPSS ≥ 0.50.0%

Protected by Waratek 0 0.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 2 100.0%

Critical 0 0.0% High 0 0.0% Medium 1 50.0% Low 1 50.0% None 0 0.0% Unknown 0 0.0%

blocked by ARMR today 0 0.0% partly blocked 0 0.0% not blocked 2 100.0% not established 0 0.0% unrecorded 0 0.0%

Exploited 0 0.0% Working exploit published 0 0.0% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 2 100.0%

split by StatusSeverityProtectionExploit maturity peak 1 / quarter

Q4 051 No exploit published1 Medium1 not blocked1 No public exploit1 Q1 060 Q2 060 Q3 060 Q4 060 Q1 070 Q2 070 Q3 070 Q4 070 Q1 080 Q2 080 Q3 080 Q4 080 Q1 090 Q2 090 Q3 090 Q4 090 Q1 100 Q2 100 Q3 101 No exploit published1 Low1 not blocked1 No public exploit1

Q1 06Q3 06Q1 07Q3 07Q1 08Q3 08Q1 09Q3 09Q1 10Q3 10

2 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.

CVE	Severity	Published▾	Status	Exploitation	Description
CVE-2009-4269	Low	2010-08-16	No exploit published	No public exploit	The password hash generation algorithm in the BUILTIN authentication functionality for Apache Derby before 10.6.1.0 performs a transformation that reduces the size of the set of inputs to SHA-1, which produces a small search space that makes it easier for local and possibly remote attackers to crack passwords by generating hash collisions, related to password substitution.
CVE-2005-4849	Medium	2005-12-31	No exploit published	No public exploit	Apache Derby before 10.1.2.1 exposes the (1) user and (2) password attributes in cleartext via (a) the RDBNAM parameter of the ACCSEC command and (b) the output of the DatabaseMetaData.getURL function, which allows context-dependent attackers to obtain sensitive information.

CVE

Severity

Published▾

Status

Exploitation

Description

CVE-2009-4269

Low

2010-08-16

No exploit published

No public exploit

The password hash generation algorithm in the BUILTIN authentication functionality for Apache Derby before 10.6.1.0 performs a transformation that reduces the size of the set of inputs to SHA-1, which produces a small search space that makes it easier for local and possibly remote attackers to crack passwords by generating hash collisions, related to password substitution.

CVE-2005-4849

Medium

2005-12-31

No exploit published

No public exploit

Apache Derby before 10.1.2.1 exposes the (1) user and (2) password attributes in cleartext via (a) the RDBNAM parameter of the ACCSEC command and (b) the output of the DatabaseMetaData.getURL function, which allows context-dependent attackers to obtain sensitive information.