Atlassian Releases Fixes for Over 2 Dozen Flaws, Including Critical Bamboo Bug

Atlassian has released patches for more than two dozen security flaws, including a critical bug impacting Bamboo Data Center and Server that could be exploited without requiring user interaction. Tracked as CVE-2024-1597, the vulnerability carries a CVSS score of 10.0, indicating maximum severity. Described as an SQL injection flaw, it's rooted in a dependency called org.postgresql:

mapXplore - Allow Exporting The Information Downloaded With Sqlmap To A Relational Database Like Postgres And Sqlite

mapXplore is a modular application that imports data extracted of the sqlmap to PostgreSQL or SQLite database.

Its main features are:

• Import of information extracted from sqlmap to PostgreSQL or SQLite for subsequent querying.
• Sanitized information, which means that at the time of import, it decodes or transforms unreadable information into readable information.
• Search for information in all tables, such as passwords, users, and desired information.

• Automatic export of information stored in base64, such as:

  • Word, Excel, PowerPoint files
  • .zip files
  • Text files or plain text information
  • Images

• Filter tables and columns by criteria.

• Filter by different types of hash functions without requiring prior conversion.
• Export relevant information to Excel or HTML

Installation

Requirements

• python-3.11

git clone https://github.com/daniel2005d/mapXplore
cd mapXplore
pip install -r requirements

Usage

It is a modular application, and consists of the following:

• config: It is responsible for configuration, such as the database engine to use, import paths, among others.
• import: It is responsible for importing and processing the information extracted from sqlmap.
• query: It is the main module capable of filtering and extracting the required information.
  • Filter by tables
  • Filter by columns
  • Filter by one or more words
  • Filter by one or more hash functions within which are:
    • MD5
    • SHA1
    • SHA256
    • SHA3
    • ....

Beginning

Allows loading a default configuration at the start of the program

python engine.py [--config config.json]

Modules

• config
• import
• principal|search

Two Critical Flaws Found in Alibaba Cloud's PostgreSQL Databases

A chain of two critical flaws has been disclosed in Alibaba Cloud's ApsaraDB RDS for PostgreSQL and AnalyticDB for PostgreSQL that could be exploited to breach tenant isolation protections and access sensitive data belonging to other customers. "The vulnerabilities potentially allowed unauthorized access to Alibaba Cloud customers' PostgreSQL databases and the ability to perform a supply chain

Kinsing Crypto Malware Hits Kubernetes Clusters via Misconfigured PostgreSQL

The threat actors behind the Kinsing cryptojacking operation have been spotted exploiting misconfigured and exposed PostgreSQL servers to obtain initial access to Kubernetes environments. A second initial access vector technique entails the use of vulnerable images, Sunders Bruskin, security researcher at Microsoft Defender for Cloud, said in a report last week. Kinsing has a storied history of

Researchers Disclose Supply-Chain Flaw Affecting IBM Cloud Databases for PostgreSQL

IBM has fixed a high-severity security vulnerability affecting its Cloud Databases (ICD) for PostgreSQL product that could be potentially exploited to tamper with internal repositories and run unauthorized code. The privilege escalation flaw (CVSS score: 8.8), dubbed "Hell's Keychain" by cloud security firm Wiz, has been described as a "first-of-its-kind supply-chain attack vector impacting a