Atlassian Releases Fixes for Over 2 Dozen Flaws, Including Critical Bamboo Bug

Atlassian has released patches for more than two dozen security flaws, including a critical bug impacting Bamboo Data Center and Server that could be exploited without requiring user interaction. Tracked as CVE-2024-1597, the vulnerability carries a CVSS score of 10.0, indicating maximum severity. Described as an SQL injection flaw, it's rooted in a dependency called org.postgresql:

mapXplore - Allow Exporting The Information Downloaded With Sqlmap To A Relational Database Like Postgres And Sqlite

mapXplore is a modular application that imports data extracted of the sqlmap to PostgreSQL or SQLite database.

Its main features are:

• Import of information extracted from sqlmap to PostgreSQL or SQLite for subsequent querying.
• Sanitized information, which means that at the time of import, it decodes or transforms unreadable information into readable information.
• Search for information in all tables, such as passwords, users, and desired information.

• Automatic export of information stored in base64, such as:

  • Word, Excel, PowerPoint files
  • .zip files
  • Text files or plain text information
  • Images

• Filter tables and columns by criteria.

• Filter by different types of hash functions without requiring prior conversion.
• Export relevant information to Excel or HTML

Installation

Requirements

• python-3.11

git clone https://github.com/daniel2005d/mapXplore
cd mapXplore
pip install -r requirements

Usage

It is a modular application, and consists of the following:

• config: It is responsible for configuration, such as the database engine to use, import paths, among others.
• import: It is responsible for importing and processing the information extracted from sqlmap.
• query: It is the main module capable of filtering and extracting the required information.
  • Filter by tables
  • Filter by columns
  • Filter by one or more words
  • Filter by one or more hash functions within which are:
    • MD5
    • SHA1
    • SHA256
    • SHA3
    • ....

Beginning

Allows loading a default configuration at the start of the program

python engine.py [--config config.json]

Modules

• config
• import
• principal|search

Two Critical Flaws Found in Alibaba Cloud's PostgreSQL Databases

A chain of two critical flaws has been disclosed in Alibaba Cloud's ApsaraDB RDS for PostgreSQL and AnalyticDB for PostgreSQL that could be exploited to breach tenant isolation protections and access sensitive data belonging to other customers. "The vulnerabilities potentially allowed unauthorized access to Alibaba Cloud customers' PostgreSQL databases and the ability to perform a supply chain

GoBruteforcer: New Golang-Based Malware Breaches Web Servers via Brute-Force Attacks

A new Golang-based malware dubbed GoBruteforcer has been found targeting web servers running phpMyAdmin, MySQL, FTP, and Postgres to corral the devices into a botnet. "GoBruteforcer chose a Classless Inter-Domain Routing (CIDR) block for scanning the network during the attack, and it targeted all IP addresses within that CIDR range," Palo Alto Networks Unit 42 researchers said. "The threat actor