20 matches found
CVE-2026-18408
A vulnerability in PostgreSQL allows a malicious origin-server superuser to achieve client-side arbitrary code execution during a database restore. By injecting untrusted data into a pgdump export, the attacker can exploit the input expansion of the psql \restrict meta-command. When a victim...
pgadmin4-9.10-CVE-2025-13780
pgadmin4 9.11 元命令过滤器命令执行 摘要 pgAdmin 在修复 Issue 9320 时引入的 PLAIN 恢复元命令过滤器，在 SQL 文件以 UTF-8 字节顺序标记 EF BB BF 或其他特殊序列开头时无法检测到元命令。该实现的过滤器使用函数 hasmetacommands，该函数通过正则表达式扫描原始字节。该正则表达式未将这些字节视为可忽略，因此诸如 ! 的元命令仍未被检测到。当 pgAdmin 使用 --file 调用 psql 时，psql 会去除这些字节并执行命令。这可能导致在恢复操作过程中执行远程命令。 此绕过影响在提交...
Unsafe Dependency Resolution
Overview Affected versions of this package are vulnerable to Unsafe Dependency Resolution via the \unrestrict meta-command input expansion in the restore process. An attacker can execute arbitrary code as the client operating system account by injecting malicious input from a compromised origin...
AZL-95705 CVE-2026-18408 affecting package postgresql 16.14-1
Untrusted data inclusion in pgdump in PostgreSQL allows a malicious superuser of the origin server to inject arbitrary code for restore-time execution as the client operating system account running psql to restore the dump, via psql \restrict meta-command input expansion. The fix for CVE-2025-871...
PYSEC-2026-450 pgadmin4 has a Meta-Command Filter Command Execution
The PLAIN restore meta-command filter introduced in pgAdmin as part of the fix for CVE-2025-12762 does not detect meta-commands when a SQL file begins with a UTF-8 Byte Order Mark EF BB BF or other special byte sequences. The implemented filter uses the function hasmetacommands, which scans raw...
pgadmin4 has a Meta-Command Filter Command Execution
The PLAIN restore meta-command filter introduced in pgAdmin as part of the fix for CVE-2025-12762 does not detect meta-commands when a SQL file begins with a UTF-8 Byte Order Mark EF BB BF or other special byte sequences. The implemented filter uses the function hasmetacommands, which scans raw...
GHSA-FXMW-JCGR-W44V pgadmin4 has a Meta-Command Filter Command Execution
The PLAIN restore meta-command filter introduced in pgAdmin as part of the fix for CVE-2025-12762 does not detect meta-commands when a SQL file begins with a UTF-8 Byte Order Mark EF BB BF or other special byte sequences. The implemented filter uses the function hasmetacommands, which scans raw...
EUVD-2020-15330
Malware in sbrugna...
CVE-2025-59337 Discourse: Cross-Site Data Exposure via Backup Restore Metacommand Injection in Multisite Deployments
Discourse is an open-source community discussion platform. In versions 3.5.0 and below, malicious meta-commands could be embedded in a backup dump and executed during restore. In multisite setups, this allowed an admin of one site to access data or credentials from other sites. This issue is fixe...
CVE-2020-22570
A vulnerability was found in Memcached. This security issue appears as a NULL pointer dereference vulnerability in memcached.c that allows remote attackers to cause a denial of service daemon crash via a crafted meta-command. Mitigation Mitigation for this issue is either not available or the...
Memcached 1.6.x < 1.6.3 DoS Vulnerability
Memcached is prone to a denial of service DoS vulnerability. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:memcached:memcached"...
CVE-2020-22570
Memcached 1.6.0 before 1.6.3 allows remote attackers to cause a denial of service daemon crash via a crafted meta command...
DEBIAN-CVE-2020-22570
Memcached 1.6.0 before 1.6.3 allows remote attackers to cause a denial of service daemon crash via a crafted meta command...
CVE-2020-22570
Memcached 1.6.0 before 1.6.3 allows remote attackers to cause a denial of service daemon crash via a crafted meta command...
CVE-2020-22570
Memcached 1.6.0 before 1.6.3 allows remote attackers to cause a denial of service daemon crash via a crafted meta command...
CVE-2020-22570
Memcached 1.6.0 before 1.6.3 allows remote attackers to cause a denial of service daemon crash via a crafted meta command...
CVE-2020-22570
Memcached 1.6.0 before 1.6.3 allows remote attackers to cause a denial of service daemon crash via a crafted meta command...
PT-2023-11622 · Memcached · Memcached
Name of the Vulnerable Software and Affected Versions: Memcached versions 1.6.0 through 1.6.2 Description: The issue allows remote attackers to cause a denial of service, resulting in a daemon crash, via a crafted meta command. Recommendations: For Memcached versions 1.6.0 through 1.6.2, update t...
The vulnerability of the “gset” meta-command implementation in the PostgreSQL database management system allows a hacker to execute arbitrary code.
The vulnerability of the “gset” meta-command in the PostgreSQL database management system is related to errors in privilege context switching. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...
CVE-2018-9507
In btaavprocmetacmd of btaavact.cc, there is a possible out of bounds read due to an incorrect bounds check. This could lead to remote information disclosure over Bluetooth with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions:...