PT-2018-14484

Name of the Vulnerable Software and Affected Versions libpg query versions 10 through 1.0.2 Description A memory leak was found in the pg query raw parse function within pg query parse.c, potentially leading to a denial of service. Recommendations For libpg query versions 10 through 1.0.2, at the...

box-node-sdk (>=1.16.0, <=1.16.1), homebridge-netatmo-schaloms (>=0.2.3, <=0.2.4) +6 more potentially affected by CVE-2018-3752 via merge-options (1.0.0)

merge-options NPM version 1.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on merge-options and may be impacted: - box-node-sdk =1.16.0, =0.2.3, =0.14.0, =0.14.0, =0.14.0, =0.14.0, =0.13.1, =2.0.0, =2.0.1 Source cves: CVE-2018-3752 Source advisory:...

Security update for python-Django (moderate)

This update for python-Django to version 2.08 fixes the following issues: The following security vulnerability was fixed: - CVE-2018-14574: Fixed an redirection vulnerability in CommonMiddleware boo1102680 The following other bugs were fixed: - Fixed a regression in Django 2.0.7 that broke the...

CVE-2016-7070

A privilege escalation flaw was found in the Ansible Tower. When Tower before 3.0.3 deploys a PostgreSQL database, it incorrectly configures the trust level of postgres user. An attacker could use this vulnerability to gain admin level access to the database...

PT-2018-4976

Name of the Vulnerable Software and Affected Versions Ansible Tower versions prior to 3.0.3 Description A privilege escalation flaw was found in Ansible Tower, where it incorrectly configures the trust level of the postgres user when deploying a PostgreSQL database. This allows an attacker to gai...

openSUSE Security Update : python-Django (openSUSE-2018-914)

This update for python-Django to version 2.08 fixes the following issues : The following security vulnerability was fixed : - CVE-2018-14574: Fixed an redirection vulnerability in CommonMiddleware boo1102680 The following other bugs were fixed : - Fixed a regression in Django 2.0.7 that broke the...

postgresql: Certain host connection parameters defeat client-side security defenses

A vulnerability was found in libpq, the default PostgreSQL client library where libpq failed to properly reset its internal state between connections. If an affected version of libpq were used with "host" or "hostaddr" connection parameters from untrusted input, attackers could bypass client-side...

@keyv/postgres (>=1.0.7, <=1.0.9), keyv-postgres (>=1.0.5, <=1.0.6) +2 more potentially affected by CVE-2017-16082 via pg (>=7.1.0, <=7.1.1)

pg NPM version =7.1.0, =1.0.7, =1.0.5, =0.0.1, =0.0.3 Source cves: CVE-2017-16082 Source advisory: OSV:GHSA-WC9V-MJ63-M9G5...

@keyv/postgres (>=1.0.7, <=1.0.9), keyv-postgres (>=1.0.5, <=1.0.6) +2 more potentially affected by CVE-2017-16082 via pg (>=7.1.0, <=7.1.1)

pg NPM version =7.1.0, =1.0.7, =1.0.5, =0.0.1, =0.0.3 Source cves: CVE-2017-16082 Source advisory: GHSA-WC9V-MJ63-M9G5...

@keyv/postgres (>=1.0.7, <=1.0.9), keyv-postgres (>=1.0.5, <=1.0.6) +2 more potentially affected by CVE-2017-16082 via pg (>=7.1.0, <=7.1.1)

pg NPM version =7.1.0, =1.0.7, =1.0.5, =0.0.1, =0.0.3 Source cves: CVE-2017-16082 Source advisory: MEND:CVE-2017-16082...

@arpinum/postgres (>=4.0.0-beta12, <=4.0.0-beta14), appointmed-epr-template-common (>=0.0.46, <=0.0.65) +9 more potentially affected by CVE-2017-16082 via pg (>=6.2.2, <=6.2.3)

pg NPM version =6.2.2, =4.0.0-beta12, =0.0.46, =0.0.35, =0.13.3, =0.0.1, =0.0.1, =1.0.0, =1.0.3 - pg-promise-strict 0.3.4 - pgo 0.2.1 Source cves: CVE-2017-16082 Source advisory: MEND:CVE-2017-16082...

CVE-2016-10554

sequelize is an Object-relational mapping, or a middleman to convert things from Postgres, MySQL, MariaDB, SQLite and Microsoft SQL Server into usable data for NodeJS. Before version 1.7.0-alpha3, sequelize defaulted SQLite to use MySQL backslash escaping, even though SQLite uses Postgres escapin...

CVE-2016-10554

sequelize is an Object-relational mapping, or a middleman to convert things from Postgres, MySQL, MariaDB, SQLite and Microsoft SQL Server into usable data for NodeJS. Before version 1.7.0-alpha3, sequelize defaulted SQLite to use MySQL backslash escaping, even though SQLite uses Postgres escapin...

CVE-2016-10553

sequelize is an Object-relational mapping, or a middleman to convert things from Postgres, MySQL, MariaDB, SQLite and Microsoft SQL Server into usable data for NodeJS. A fix was pushed out that fixed potential SQL injection in sequelize 2.1.3 and earlier...

CVE-2016-10553

sequelize is an Object-relational mapping, or a middleman to convert things from Postgres, MySQL, MariaDB, SQLite and Microsoft SQL Server into usable data for NodeJS. A fix was pushed out that fixed potential SQL injection in sequelize 2.1.3 and earlier...

Sql injection

sequelize is an Object-relational mapping, or a middleman to convert things from Postgres, MySQL, MariaDB, SQLite and Microsoft SQL Server into usable data for NodeJS. A fix was pushed out that fixed potential SQL injection in sequelize 2.1.3 and earlier...

Code injection

sequelize is an Object-relational mapping, or a middleman to convert things from Postgres, MySQL, MariaDB, SQLite and Microsoft SQL Server into usable data for NodeJS. Before version 1.7.0-alpha3, sequelize defaulted SQLite to use MySQL backslash escaping, even though SQLite uses Postgres escapin...

CVE-2016-10553

sequelize is an Object-relational mapping, or a middleman to convert things from Postgres, MySQL, MariaDB, SQLite and Microsoft SQL Server into usable data for NodeJS. A fix was pushed out that fixed potential SQL injection in sequelize 2.1.3 and earlier...

CVE-2016-10553

CVE-2016-10553 affects the Node.js ORM sequelize . The vulnerability is a SQL Injection when user input is concatenated into queries, specifically in patterns like findOne or where: "user input". Affected versions are the pre-3.0 releases; the recommended fix is to upgrade to version 3.0.0 or lat...

CVE-2016-10550

sequelize is an Object-relational mapping, or a middleman to convert things from Postgres, MySQL, MariaDB, SQLite and Microsoft SQL Server into usable data for NodeJS If user input goes into the limit or order parameters, a malicious user can put in their own SQL statements. This affects sequeliz...