PostgreSQL -- SET ROLE, SET SESSION AUTHORIZATION reset to wrong user ID

PostgreSQL project reports: Incorrect privilege assignment in PostgreSQL allows a less-privileged application user to view or change different rows from those intended. An attack requires the application to use SET ROLE, SET SESSION AUTHORIZATION, or an equivalent feature. The problem arises when...

Vulnerability in core server (CVE-2024-10978)

PostgreSQL SET ROLE, SET SESSION AUTHORIZATION reset to wrong user ID Incorrect privilege assignment in PostgreSQL allows a less-privileged application user to view or change different rows from those intended. An attack requires the application to use SET ROLE, SET SESSION AUTHORIZATION, or an...

PostgreSQL -- PostgreSQL row security below e.g. subqueries disregards user ID changes

PostgreSQL project reports: Incomplete tracking in PostgreSQL of tables with row security allows a reused query to view or change different rows from those intended. CVE-2023-2455 and CVE-2016-2193 fixed most interaction between row security and user ID changes. They missed cases where a subquery...

How to Migrate the Configuration and Repository Cache Databases

Article Applicability This article is intended for use in environments where Veeam Backup for Microsoft 365 8 is already installed. The information provided in this article outlines the process for migrating the Configuration and Cache Databases from one PostgreSQL instance to another, including...

CVE-2024-49042

Azure Database for PostgreSQL Flexible Server Extension Elevation of Privilege Vulnerability...

CVE-2024-49042

Azure Database for PostgreSQL Flexible Server Extension Elevation of Privilege Vulnerability...

CVE-2024-43613

Azure Database for PostgreSQL Flexible Server Extension Elevation of Privilege Vulnerability...

CVE-2024-43613

Azure Database for PostgreSQL Flexible Server Extension Elevation of Privilege Vulnerability...

CVE-2024-43613 Azure Database for PostgreSQL Flexible Server Extension Elevation of Privilege Vulnerability

...

CVE-2024-43613

CVE-2024-43613 affects Azure Database for PostgreSQL Flexible Server. Connected PT-security data indicates an elevation of privilege vulnerability tied to a failure to properly clean up data at the management level, enabling a remote attacker to elevate privileges within Flexible Server. The Azur...

CVE-2024-43613 Azure Database for PostgreSQL Flexible Server Extension Elevation of Privilege Vulnerability

...

CVE-2024-49042 Azure Database for PostgreSQL Flexible Server Extension Elevation of Privilege Vulnerability

...

CVE-2024-49042

CVE-2024-49042 concerns an elevation-of-privilege vulnerability in Azure Database for PostgreSQL Flexible Server . The connected documents describe a vulnerability in the Flexible Server component and note a failure in proper cleanup at the management level, enabling privilege escalation. Some so...

CVE-2024-49042 Azure Database for PostgreSQL Flexible Server Extension Elevation of Privilege Vulnerability

...

Azure Database for PostgreSQL Flexible Server Extension Elevation of Privilege Vulnerability

...

Azure Database for PostgreSQL Flexible Server Extension Elevation of Privilege Vulnerability

...

Security Bulletin: IBM Sterling Connect:Direct Web Services is affected by PostgreSQL TOCTOU vulnerability

Summary IBM Sterling Connect:Direct Web Services uses PostgreSQL, PostgreSQL could allow a remote authenticated attacker to gain elevated privileges on the system, caused by a tme-of-check time-of-use TOCTOU race condition in pgdump. Vulnerability Details CVEID:CVE-2024-7348 DESCRIPTION: PostgreS...

KLA77104 Multiple vulnerabilities in Microsoft Azure

Multiple vulnerabilities were found in Microsoft Azure. Malicious users can exploit these vulnerabilities to gain privileges, execute arbitrary code. Below is a complete list of vulnerabilities: 1. An elevation of privilege vulnerability in Azure Database for PostgreSQL Flexible Server Extension...

Microsoft Azure Database for PostgreSQL 命令注入漏洞

Microsoft Azure Database for PostgreSQL is a fully managed database service from Microsoft Corporation USA capable of handling mission-critical workloads with predictable performance, security, high availability, and dynamic scalability. A command injection vulnerability exists in Microsoft Azure...

This Week in Spring - November 12th, 2024

Hi, Spring fans! Welcome to another installment of This Week in Spring! Spring Cloud 2024.0.0-RC1 aka Moorgate has been released In this installment of A Bootiful Podcast , I talk to Gradle developer advocate Baruch Sadogursky good news everybody! GraalVM will now support jcmd, which allows you t...