I recently checked the changelog of rundesk. One possible reason for upgrading was a CVE scored 'high'. This one: https://nvd.nist.gov/vuln/detail/CVE-2022-45868 Total waste of everybody's time. You have to start h2 as server, instead of as dependency. You then have to start it with a command line parameter with a password, instead of specifying it in a config file. Both actions scream debug-configuration. If you do…
Yeah, having to deal with the level 10 CVE for Postgres from Tuesday.
https://nvd.nist.gov/vuln/detail/CVE-2024-1597
Postgres drivers are now all highly vulnerable and blocked in our pipelines because of overeager security, level 10 means that we can't get waivers for it either.
But you can't exploit because no one uses PreferQueryMode=SIMPLE.