CVE-2023-2454

schemaelement defeats protective searchpath changes; It was found that certain database calls in PostgreSQL could permit an authed attacker with elevated database-level privileges to execute arbitrary code...

CVE-2023-2455

Row security policies disregard user ID changes after inlining; PostgreSQL could permit incorrect policies to be applied in certain cases where role-specific policies are used and a given query is planned under one role and then executed under other roles. This scenario can happen under security...

CVE-2023-2455

Row security policies disregard user ID changes after inlining; PostgreSQL could permit incorrect policies to be applied in certain cases where role-specific policies are used and a given query is planned under one role and then executed under other roles. This scenario can happen under security...

Arbitrary Code Execution

postgresql is vulnerable to Arbitrary Code Execution. The vulnerability is available within the 'CREATE SCHEMA' statement and can be used by a malicious attacker with database-level 'CREATE' privilege to bypass the protective 'searchpath' changes and execute arbitrary code as the bootstrap...

Information Disclosure

postgresql is vulnerable to Information Disclosure. The vulnerability relates to a issue in function inlining where role specific policies can be executed other roles resulting in an incorrect policy which may permit a user to complete otherwise-forbidden reads and modifications...

GHSA-26C5-PPR8-F33P Synapse has improper checks for deactivated users during login

Impact It may be possible for a deactivated user to login when using uncommon configurations. This only applies if any of the following are true: JSON Web Tokens are enabled for login via the jwtconfig.enabled configuration setting The local password database is enabled via the...

Synapse has improper checks for deactivated users during login

Impact It may be possible for a deactivated user to login when using uncommon configurations. This only applies if any of the following are true: JSON Web Tokens are enabled for login via the jwtconfig.enabled configuration setting The local password database is enabled via the...

SQL injection when using MySQL/PostgreSQL data checking

An SQL injection issue was discovered in EaseProbe before 2.1.0 when using MySQL/PostgreSQL data checking. This problem has been fixed in v2.1.0; users should upgrade to this version. The vulnerability was discovered by the Oxeye research team...

GHSA-4C32-W6C7-77X4 SQL injection when using MySQL/PostgreSQL data checking

An SQL injection issue was discovered in EaseProbe before 2.1.0 when using MySQL/PostgreSQL data checking. This problem has been fixed in v2.1.0; users should upgrade to this version. The vulnerability was discovered by the Oxeye research team...

CVE-2019-10208 -TYPE in pg_temp executes arbitrary SQL during SECURITY DEFINER execution

A flaw was discovered in postgresql versions 9.4.x before 9.4.24, 9.5.x before 9.5.19, 9.6.x before 9.6.15, 10.x before 10.10 and 11.x before 11.5 where arbitrary SQL statements can be executed given a suitable SECURITY DEFINER function. An attacker, with EXECUTE permission on the function, can...

The vulnerability of the Schema Handler component in the PostgreSQL database management system allows attackers to circumvent security restrictions.

The vulnerability of the Schema Handler component in the PostgreSQL database management system is related to security configuration errors. Exploiting this vulnerability allows a malicious actor to bypass security restrictions remotely...

The vulnerability of the EaseProbe tool for checking functionality/status involves a lack of measures to protect the SQL query structure, allowing attackers to execute arbitrary SQL code.

The vulnerability of the EaseProbe tool for checking functionality/status involves a lack of measures taken to protect the SQL query structure during data processing in MySQL/PostgreSQL databases. Exploiting this vulnerability allows attackers to execute arbitrary SQL code...

CVE-2023-33967

EaseProbe is a tool that can do health/status checking. An SQL injection issue was discovered in EaseProbe before 2.1.0 when using MySQL/PostgreSQL data checking. This problem has been fixed in v2.1.0...

Sql injection

EaseProbe is a tool that can do health/status checking. An SQL injection issue was discovered in EaseProbe before 2.1.0 when using MySQL/PostgreSQL data checking. This problem has been fixed in v2.1.0...

CVE-2023-33967 EaseProbe vulnerable to SQL injection when using MySQL/PostgreSQL data checking

EaseProbe is a tool that can do health/status checking. An SQL injection issue was discovered in EaseProbe before 2.1.0 when using MySQL/PostgreSQL data checking. This problem has been fixed in v2.1.0...

CVE-2023-33967 EaseProbe vulnerable to SQL injection when using MySQL/PostgreSQL data checking

EaseProbe is a tool that can do health/status checking. An SQL injection issue was discovered in EaseProbe before 2.1.0 when using MySQL/PostgreSQL data checking. This problem has been fixed in v2.1.0...

CVE-2023-33967 EaseProbe vulnerable to SQL injection when using MySQL/PostgreSQL data checking

EaseProbe is a tool that can do health/status checking. An SQL injection issue was discovered in EaseProbe before 2.1.0 when using MySQL/PostgreSQL data checking. This problem has been fixed in v2.1.0...

MGASA-2023-0187 Updated postgresql packages fix security vulnerability

CREATE SCHEMA ... schemaelement defeats protective searchpath changes. CVE-2023-2454 Row security policies disregard user ID changes after inlining. CVE-2023-2455...

Updated postgresql packages fix security vulnerability

CREATE SCHEMA ... schemaelement defeats protective searchpath changes. CVE-2023-2454 Row security policies disregard user ID changes after inlining. CVE-2023-2455...

The vulnerability of the aiven-extras extension of the PostgreSQL database management system allows a hacker to gain superuser privileges, execute arbitrary code, and disclose sensitive information.

The vulnerability of the aiven-extras extension in the PostgreSQL database management system is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to gain superuser privileges, execute arbitrary code, and disclose sensitive information...