npm pg-native 代码问题漏洞

npm pg-native is a high-performance native binding between node.js and PostgreSQL from US-based npm, using a simple API via libpq. A code issue vulnerability exists in pg-native that stems from the plugin's susceptibility to a denial of service DoS when it attempts to convert the second parameter...

PT-2022-17569 · Npm · Libpq +1

Name of the Vulnerable Software and Affected Versions: pg-native versions prior to 3.0.1 libpq versions prior to 1.8.10 Description: The issue is related to a Denial of Service DoS condition that occurs when the addons attempt to cast the second argument to an array and fail. This happens for eve...

pg-riders.at Cross Site Scripting vulnerability OBB-2646699

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

postgresql: Autovacuum, REINDEX, and others omit "security restricted operation" sandbox

A flaw was found in PostgreSQL. There is an issue with incomplete efforts to operate safely when a privileged user is maintaining another user's objects. The Autovacuum, REINDEX, CREATE INDEX, REFRESH MATERIALIZED VIEW, CLUSTER, and pgamcheck commands activated relevant protections too late or no...

DEBIAN-CVE-2022-1789

With shadow paging enabled, the INVPCID instruction results in a call to kvmmmuinvpcidgva. If INVPCID is executed with CR0.PG=0, the invlpg callback is not set and the result is a NULL pointer dereference...

Malicious code in dai-pg (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 380a8ec5aad17aa31577c83a6d88aa6060b4631380bc351d846ef8b6d9d0a1e8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2022-1789

CVE-2022-1789 targets KVM in the Linux kernel. With shadow paging enabled, INVPCID can lead to a NULL pointer dereference when CR0.PG=0, because the invlpg callback is not set, causing a crash in kvm_mmu_invpcid_gva. The same issue is echoed in Astra Linux and AlmaLinux advisories, which list KVM...

CVE-2022-1789

A flaw was found in KVM. With shadow paging enabled if INVPCID is executed with CR0.PG=0, the invlpg callback is not set, and the result is a NULL pointer dereference. This flaw allows a guest user to cause a kernel oops condition on the host, resulting in a denial of service. Mitigation Mitigati...

MAL-2022-5312 Malicious code in pg-ng-popover (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b7eae5ce3ffe7a6a45252fbf8e9e7baab3dd7e94d06676793c490eaa77094a06 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in pg-ng-popover (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b7eae5ce3ffe7a6a45252fbf8e9e7baab3dd7e94d06676793c490eaa77094a06 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

new packages: rubygem-pg

An update is available for rubygem-pg. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list For detailed information on changes in this release, see the Rocky...

new packages: perl-DBD-Pg

An update is available for perl-DBD-Pg. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list For detailed information on changes in this release, see the Rocky...

Vulnerability fixed in PostgreSQL

The developers of PostgreSQL have fixed a vulnerability in PostgreSQL. It was found that certain commands such as Autovacuum, REINDEX, CREATE INDEX, REFRESH MATERIALIZED VIEW, CLUSTER and pgamcheck do not handle permissions correctly, allowing a user to can execute these commands outside the scop...

TRENDnet TI-PG1284i Integer Underflow Vulnerability

The TRENDnet TI-PG Series is a series of switches from TRENDnet. A security vulnerability exists in TRENDnet TI-PG1284i versions prior to 2.0.2.S0, no details of the vulnerability are provided at this time...

UBUNTU-CVE-2022-1552

A flaw was found in PostgreSQL. There is an issue with incomplete efforts to operate safely when a privileged user is maintaining another user's objects. The Autovacuum, REINDEX, CREATE INDEX, REFRESH MATERIALIZED VIEW, CLUSTER, and pgamcheck commands activated relevant protections too late or no...

PT-2022-2514 · Unknown +11 · Postgresql +10

Name of the Vulnerable Software and Affected Versions: PostgreSQL affected versions not specified Description: A flaw was found in PostgreSQL related to incomplete efforts to operate safely when a privileged user is maintaining another user's objects. The Autovacuum, REINDEX, CREATE INDEX, REFRES...

5.32 metadata for the Rocky Linux 8 module matrix (4/4)

An update is available for perl-DBD-Pg. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list For detailed information on changes in this release, see the Rocky Linux...

@abeai/job-consumer (>=3.5.0 <=3.7.0), @abeai/node-logging (>=7.5.0 <=7.10.0) +14 more potentially affected by CVE-2022-25852 via pg-native (=3.0.0)

pg-native NPM version =3.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on pg-native and may be impacted: - @abeai/job-consumer =3.5.0, =7.5.0, =6.3.0, =1.1.1, =0.0.1, =10.0.0, =10.0.0, =1.0.0, =1.0.0, =1.3.1, =2.0.4, =0.0.2, =1.0.2 and more Source...

Denial of Service (DoS)

Overview libpq is a node native bindings to the PostgreSQL libpq C client library. Affected versions of this package are vulnerable to Denial of Service DoS when the addons attempt to cast the second argument to an array and fail. This happens for every non-array argument passed. Note: pg-native ...

Denial of Service (DoS)

Overview pg-native is a high performance native bindings between node.js and PostgreSQL via libpq with a simple API. Affected versions of this package are vulnerable to Denial of Service DoS when the addons attempt to cast the second argument to an array and fail. This happens for every non-array...