PostgreSQL RCE Vulnerability (Feb 2018) - Linux

PostgreSQL is prone to a remote code execution RCE vulnerability. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

PostgreSQL 9.3.x < 9.3.22 / 9.4.x < 9.4.17 / 9.5.x < 9.5.12 / 9.6.x < 9.6.8 / 10.x < 10.3 Privilege Escalation Vulnerability

The version of PostgreSQL installed on the remote host is 9.3.x prior to 9.3.22, 9.4.x prior to 9.4.17, 9.5.x prior to 9.5.12, 9.6.x prior to 9.6.8, or 10.x prior to 10.3. It is, therefore, affected by a privilege escalation vulnerability. %NASLMINLEVEL 70300 C Tenable Network Security, Inc...

PostgreSQL Information Disclosure Vulnerability (Feb 2018) - Linux

PostgreSQL is prone to an information disclosure vulnerability. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

PostgreSQL Information Disclosure Vulnerability (Feb 2018) - Windows

PostgreSQL is prone to an information disclosure vulnerability. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Arbitrary file deletion

In postgresql 9.3.x before 9.3.21, 9.4.x before 9.4.16, 9.5.x before 9.5.11, 9.6.x before 9.6.7 and 10.x before 10.2, pgupgrade creates file in current working directory containing the output of pgdumpall -g under umask which was in effect when the user invoked pgupgrade, and not under 0077 which...

Cross site scripting

IBM DOORS 9.5 and 9.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 130411...

CVE-2017-1532

IBM DOORS 9.5 and 9.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 130411...

CVE-2017-1545

IBM Doors Web Access 9.5 and 9.6 could allow an attacker with physical access to the system to log into the application using previously stored credentials. IBM X-Force ID: 130914...

CVE-2017-1515

IBM Doors Web Access 9.5 and 9.6 could allow an authenticated user to obtain sensitive information from HTTP internal server error responses. IBM X-Force ID: 129825...

CVE-2017-1563

CVE-2017-1563 affects IBM Rational DOORS Web Access (versions 9.5 and 9.6). The vulnerability is a cross-site scripting flaw in the Web UI that could let an attacker inject arbitrary JavaScript, potentially leading to credentials disclosure within a trusted session. Affected components include Ra...

CVE-2017-1515

CVE-2017-1515 — IBM DOORS Web Access information disclosure . Affected: Rational DOORS 9.5.x and 9.6.x (Rational DOORS Web Access). Description: an authenticated user could obtain sensitive information from HTTP internal server error responses due to the vulnerability in DOORS Web Access. Root ca...

CVE-2017-1545

IBM Doors Web Access (Rational DOORS) versions 9.5 and 9.6 are affected by a vulnerability where an attacker with physical access can log into the application using previously stored credentials. The issue affects Rational DOORS Desktop Client, Web Access, and interoperation server across 9.5.0.0...

CVE-2017-1516

IBM Doors Web Access 9.5 and 9.6 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch further attacks against the...

CVE-2017-1516

Summary (CVE-2017-1516) IBM Doors Web Access (versions 9.5.x and 9.6.x) is vulnerable to a clickjacking-style issue where a remote attacker lures a victim to a malicious site and hijacks the user’s click actions, potentially enabling further attacks. Affected components include Rational DOORS Web...

CVE-2017-1567

IBM Doors Web Access 9.5 and 9.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 131769...

CVE-2017-1532

IBM DOORS 9.5–9.6 is affected by a cross-site scripting vulnerability in the Web UI that could allow an attacker to inject JavaScript and potentially disclose credentials within a trusted session. The issue affects Rational DOORS components including the desktop client, Web Access, and interopera...

Tuleap 9.6 Second-Order PHP Object Injection Exploit

This Metasploit module exploits a Second-Order PHP Object Injection vulnerability in Tuleap 'Tuleap 9.6 Second-Order PHP Object Injection', 'Description' = %q This module exploits a Second-Order PHP Object Injection vulnerability in Tuleap = 9.6 which could be abused by authenticated users to...

PostgreSQL Security Bypass Vulnerability (Dec 2017) - Windows

PostgreSQL is prone to a security bypass vulnerability. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:postgresql:postgresql";...

PostgreSQL Security Bypass Vulnerability (Dec 2017) - Linux

PostgreSQL is prone to a security bypass vulnerability. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:postgresql:postgresql";...

PostgreSQL Privilege Escalation Vulnerability (Dec 2017) - Windows

PostgreSQL is prone to a privilege escalation vulnerability. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...