1762 matches found
postgresql: extension script @substitutions@ within quoting allow SQL injection
IN THE EXTENSION SCRIPT, a SQL Injection vulnerability was found in PostgreSQL if it uses @extowner@, @extschema@, or @extschema:...@ inside a quoting construct dollar quoting, '', or "". If an administrator has installed files of a vulnerable, trusted, non-bundled extension, an attacker with...
UBUNTU-CVE-2021-37937
An issue was found with how API keys are created with the Fleet-Server service account. When an API key is created with a service account, it is possible that the API key could be created with higher privileges than intended. Using this vulnerability, a compromised Fleet-Server service account...
MGASA-2023-0324 Updated postgresql packages fix security vulnerabilities
The updated packages fix security vulnerabilities: Memory disclosure in aggregate function calls. CVE-2023-5868 Buffer overrun from integer overflow in array modification. CVE-2023-5869 Role pgsignalbackend can signal certain superuser processes. CVE-2023-5870...
Updated postgresql packages fix security vulnerabilities
The updated packages fix security vulnerabilities: Memory disclosure in aggregate function calls. CVE-2023-5868 Buffer overrun from integer overflow in array modification. CVE-2023-5869 Role pgsignalbackend can signal certain superuser processes. CVE-2023-5870...
SUSE-SU-2023:4479-1 Security update for postgresql14
This update for postgresql14 fixes the following issues: Security issues fixed: CVE-2023-5868: Fix handling of unknown-type arguments in DISTINCT 'any' aggregate functions. This error led to a text-type value being interpreted as an unknown-type value that is, a zero-terminated string at runtime...
FreeBSD : postgresql-server -- Role pg_cancel_backend can signal certain superuser processes (bbb18fcb-7f0d-11ee-94b4-6cc21735f730)
The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the bbb18fcb-7f0d-11ee-94b4-6cc21735f730 advisory. - Role pgcancelbackend can signal certain superuser processesmore details CVE-2023-5870 Note that Nessu...
postgresql-server -- Role pg_cancel_backend can signal certain superuser processes
PostgreSQL Project reports: Documentation says the pgcancelbackend role cannot signal "a backend owned by a superuser". On the contrary, it can signal background workers, including the logical replication launcher. It can signal autovacuum workers and the autovacuum launcher. Signaling autovacuum...
Vulnerability in core server (CVE-2023-5870)
Role "pgsignalbackend" can signal certain superuser processes Documentation says the pgsignalbackend role cannot signal "a backend owned by a superuser". On the contrary, it can signal background workers, including the logical replication launcher. It can signal autovacuum workers and the...
PT-2023-6889 · Unknown +11 · Postgresql +10
Name of the Vulnerable Software and Affected Versions: PostgreSQL affected versions not specified Description: The issue is related to the pg signal backend role in PostgreSQL, which allows signaling certain superuser processes. This can be exploited by a remote high-privileged user to launch a...
Rocky Linux 8 : postgresql:10 (RLSA-2023:0113)
The remote Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2023:0113 advisory. - A vulnerability was found in PostgreSQL. This attack requires permission to create non-temporary objects in at least one schema, the ability to lure or wait fo...
CVE-2023-45899
An issue in the component SuperUserSetuserModuleFrontController:init of idnovate superuser before v2.4.2 allows attackers to bypass authentication via a crafted HTTP call...
CVE-2023-45899
An issue in the component SuperUserSetuserModuleFrontController:init of idnovate superuser before v2.4.2 allows attackers to bypass authentication via a crafted HTTP call...
CVE-2023-45899
An issue in the component SuperUserSetuserModuleFrontController:init of idnovate superuser before v2.4.2 allows attackers to bypass authentication via a crafted HTTP call...
Authentication flaw
An issue in the component SuperUserSetuserModuleFrontController:init of idnovate superuser before v2.4.2 allows attackers to bypass authentication via a crafted HTTP call...
CVE-2023-45899
An issue in the component SuperUserSetuserModuleFrontController:init of idnovate superuser before v2.4.2 allows attackers to bypass authentication via a crafted HTTP call...
CVE-2023-45899
An issue in the component SuperUserSetuserModuleFrontController:init of idnovate superuser before v2.4.2 allows attackers to bypass authentication via a crafted HTTP call...
PT-2023-29753 · Idnovate · Idnovate Superuser
Name of the Vulnerable Software and Affected Versions: idnovate superuser versions prior to 2.4.2 Description: The issue allows attackers to bypass authentication via a crafted HTTP call, specifically targeting the SuperUserSetuserModuleFrontController:init component. Recommendations: For version...
CVE-2023-45899
The CVE-2023-45899 relates to idnovate Superuser: prior to v2.4.2, the SuperUserSetuserModuleFrontController:init() component allows bypassing authentication via a crafted HTTP call. Impact is authenticated bypass (no confidentiality / integrity if mitigated) as described; affected software is id...
PrestaShop Security Breach
PrestaShop is an open source e-commerce solution from PrestaShop, Inc. in the United States. The solution provides multiple payment methods, short message alerts and product image zoom and other features. A security vulnerability exists in PrestaShop idnovate superuser before version v2.4.2, whic...
Bosch ctrlX HMI Web Panel WR21 Access Control Error Vulnerability
Bosch ctrlX HMI Web Panel WR21 is an HMI panel from Bosch Germany. A security vulnerability exists in the Bosch ctrlX HMI Web Panel WR21 version that originates from a vulnerability that allows an unprivileged attacker with privileged access to the TPC-110W device subnet to gain root privileges a...