Lucene search
+L

13253 matches found

OSV
OSV
added 2019/08/18 12:39 p.m.11 views

MGASA-2019-0225 Updated postgresql packages fix security vulnerabilities

Updated postgresql packages fix security vulnerabilities: Given a suitable SECURITY DEFINER function, an attacker can execute arbitrary SQL under the identity of the function owner. An attack requires EXECUTE permission on the function, which must itself contain a function call having inexact...

8.8CVSS6.8AI score0.0217EPSS
SaveExploits0References6
Mageia
Mageia
added 2019/08/18 12:39 p.m.45 views

Updated postgresql packages fix security vulnerabilities

Updated postgresql packages fix security vulnerabilities: Given a suitable SECURITY DEFINER function, an attacker can execute arbitrary SQL under the identity of the function owner. An attack requires EXECUTE permission on the function, which must itself contain a function call having inexact...

8.8CVSS3.6AI score0.0217EPSS
SaveExploits0References5
CNVD
CNVD
added 2019/08/16 12:0 a.m.5 views

Zoho ManageEngine Application Manager SQL Injection Vulnerability (CNVD-2019-34851)

Zoho ManageEngine Application Manager is an application monitoring and management system from Zoho. The system is mainly used to monitor server and application performance. A SQL injection vulnerability exists in Zoho ManageEngine Application Manager. An attacker can exploit this vulnerability to...

9CVSS8.3AI score0.07789EPSS
SaveExploits2References1
Tenable Nessus
Tenable Nessus
added 2019/08/16 12:0 a.m.48 views

PostgreSQL 9.4.x < 9.4.24 / 9.5.x < 9.5.19 / 9.6.x < 9.6.15 / 10.x < 10.10 / 11.x < 11.5 Multiple Vulnerabilities

The version of PostgreSQL installed on the remote host is 9.4.x prior to 9.4.24, 9.5.x prior to 9.5.19, 9.6.x prior to 9.6.15, 10.x prior to 10.10, or 11.x prior to 11.5. It is, therefore, affected by multiple vulnerabilities : - An unspecified vulnerability that allows an attacker to execute...

9.8CVSS8.2AI score0.0217EPSS
SaveExploits0References9
CNVD
CNVD
added 2019/08/15 12:0 a.m.6 views

WordPress simple-login-log plugin SQL injection vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers. simple-login-log is a user login logging plugin used in it. A SQL injection vulnerability exists in the WordPress simple-login-log...

9.8CVSS8AI score0.01736EPSS
SaveExploits0References1
Tenable Nessus
Tenable Nessus
added 2019/08/12 12:0 a.m.235 views

Debian DLA-1874-1 : postgresql-9.4 security update

CVE-2019-10208: TYPE in pgtemp executes arbitrary SQL during SECURITY DEFINER execution Versions Affected: 9.4 - 11 Given a suitable SECURITY DEFINER function, an attacker can execute arbitrary SQL under the identity of the function owner. An attack requires EXECUTE permission on the function,...

8.8CVSS7.5AI score0.0217EPSS
SaveExploits0References4
Tenable Nessus
Tenable Nessus
added 2019/08/12 12:0 a.m.85 views

Ubuntu 16.04 LTS / 18.04 LTS : PostgreSQL vulnerabilities (USN-4090-1)

The remote Ubuntu 16.04 LTS / 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4090-1 advisory. Tom Lane discovered that PostgreSQL did not properly restrict functions declared as SECURITY DEFINER. An attacker could use this to execute...

8.8CVSS7.1AI score0.0217EPSS
SaveExploits0References3
OpenVAS
OpenVAS
added 2019/08/10 12:0 a.m.46 views

Debian: Security Advisory (DLA-1874-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

8.8CVSS7.2AI score0.0217EPSS
SaveExploits0References4
CNVD
CNVD
added 2019/08/09 12:0 a.m.3 views

PostgreSQL SQL Injection Vulnerability

PostgreSQL is a free object-relational database management system from the PostgreSQL organization. The system supports most of the SQL standards and provides many other features, such as foreign keys, triggers, views, and so on. A SQL injection vulnerability exists in PostgreSQL versions 9.4...

8.8CVSS8.4AI score0.0217EPSS
SaveExploits0References1
RedhatCVE
RedhatCVE
added 2019/08/08 6:52 p.m.46 views

CVE-2019-10208

A flaw was discovered in postgresql where arbitrary SQL statements can be executed given a suitable SECURITY DEFINER function. An attacker, with EXECUTE permission on the function, can execute arbitrary SQL as the owner of the function. Mitigation If your use case requires SECURITY DEFINER...

8.8CVSS2.7AI score0.0217EPSS
SaveExploits0References4
FreeBSD
FreeBSD
added 2019/08/08 12:0 a.m.65 views

PostgresSQL -- TYPE in pg_temp execute arbitrary SQL during `SECURITY DEFINER` execution

The PostgreSQL project reports: Versions Affected: 9.4 - 11 Given a suitable SECURITY DEFINER function, an attacker can execute arbitrary SQL under the identity of the function owner. An attack requires EXECUTE permission on the function, which must itself contain a function call having inexact...

6CVSS1.8AI score0.0369EPSS
SaveExploits0References1
UbuntuCve
UbuntuCve
added 2019/08/08 12:0 a.m.33 views

CVE-2019-10208

A flaw was discovered in postgresql versions 9.4.x before 9.4.24, 9.5.x before 9.5.19, 9.6.x before 9.6.15, 10.x before 10.10 and 11.x before 11.5 where arbitrary SQL statements can be executed given a suitable SECURITY DEFINER function. An attacker, with EXECUTE permission on the function, can...

8.8CVSS7.2AI score0.0217EPSS
SaveExploits0References3
OSV
OSV
added 2019/08/08 12:0 a.m.4 views

UBUNTU-CVE-2019-10208

A flaw was discovered in postgresql versions 9.4.x before 9.4.24, 9.5.x before 9.5.19, 9.6.x before 9.6.15, 10.x before 10.10 and 11.x before 11.5 where arbitrary SQL statements can be executed given a suitable SECURITY DEFINER function. An attacker, with EXECUTE permission on the function, can...

8.8CVSS7.4AI score0.0217EPSS
SaveExploits0References4
PostrgeSql
PostrgeSql
added 2019/08/08 12:0 a.m.114 views

Vulnerability in core server (CVE-2019-10208)

TYPE in pgtemp executes arbitrary SQL during SECURITY DEFINER execution Given a suitable SECURITY DEFINER function, an attacker can execute arbitrary SQL under the identity of the function owner. An attack requires EXECUTE permission on the function, which must itself contain a function call havi...

8.8CVSS8.5AI score0.0217EPSS
SaveExploits0References1Affected Software1
OSV
OSV
added 2019/08/07 5:15 p.m.19 views

CVE-2019-5476

An SQL Injection in the Nextcloud Lookup-Server v0.3.0 running on https://lookup.nextcloud.com caused unauthenticated users to be able to execute arbitrary SQL commands...

9.8CVSS8.4AI score
SaveExploits0References1
OpenVAS
OpenVAS
added 2019/08/07 12:0 a.m.41 views

WordPress Advanced Contact form 7 DB Plugin < 1.6.2 SQL Injection Vulnerability

The WordPress plugin Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribute it and/or modify it...

9.8CVSS9.7AI score0.03995EPSS
SaveExploits1References3
CNVD
CNVD
added 2019/08/07 12:0 a.m.75 views

WordPress BearDev JoomSport Plugin SQL Injection Vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports setting up personal blog sites on PHP and MySQL servers.BearDev JoomSport plugin is a plugin used in it to build sports sites. A SQL injection vulnerability exists in the WordPress...

9.8CVSS8AI score0.20512EPSS
SaveExploits5References1
NVD
NVD
added 2019/08/06 2:15 p.m.22 views

CVE-2019-14695

A SQL injection vulnerability exists in the Sygnoos Popup Builder plugin before 3.45 for WordPress. Successful exploitation of this vulnerability would allow a remote attacker to execute arbitrary SQL commands on the affected system via com/libs/Table.php because Subscribers Table ordering is...

9.8CVSS9.9AI score0.02727EPSS
SaveExploits0References3
Prion
Prion
added 2019/08/06 2:15 p.m.19 views

Sql injection

A SQL injection vulnerability exists in the Sygnoos Popup Builder plugin before 3.45 for WordPress. Successful exploitation of this vulnerability would allow a remote attacker to execute arbitrary SQL commands on the affected system via com/libs/Table.php because Subscribers Table ordering is...

7.5CVSS9.8AI score0.02727EPSS
SaveExploits0References3Affected Software1
Cvelist
Cvelist
added 2019/07/30 5:31 p.m.34 views

CVE-2019-14313

A SQL injection vulnerability exists in the 10Web Photo Gallery plugin before 1.5.31 for WordPress. Successful exploitation of this vulnerability would allow a remote attacker to execute arbitrary SQL commands on the affected system via filemanager/model.php...

9.9AI score0.04482EPSS
SaveExploits0References4
Rows per page
Query Builder