CVE-2023-22626: Generation of Error Message Containing Sensitive Information

PgHero before 3.1.0 allows Information Disclosure via EXPLAIN because query results may be present in an error message. Depending on database user privileges, this may only be information from the database, or may be information from file contents on the database server...

PT-2023-18595 · Pghero · Pghero

Name of the Vulnerable Software and Affected Versions: PgHero versions prior to 3.1.0 Description: The issue allows information disclosure via EXPLAIN, as query results may be present in an error message. Depending on database user privileges, this may disclose information from the database or fr...

Information Disclosure Through EXPLAIN Feature

A malicious PgHero user can use the EXPLAIN functionality to extract data from the database. With certain inputs, a user can get the results of a query to appear in an error message. If the PgHero database user has superuser privileges not recommended, the user can use file access functions to re...

Cross-site Request Forgery (CSRF)

PgHero is vulnerable to cross-site request forgery CSRF. The vulnerability exists as it does not check for authenticity tokens for non-session based authentication methods...

PgHero gem cross-site request forgery vulnerability

PgHero gem is a performance dashboard package for PostgreSQL by Andrew Kane Software Developers, USA. A cross-site request forgery vulnerability exists in PgHero gem version 2.6.0 and earlier. The vulnerability stems from a WEB application that does not adequately validate that a request is comin...

Cross-site Request Forgery (CSRF)

Overview pghero is a performance dashboard for Postgres. Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF. The Ruby gem is vulnerable with non-session based authentication methods like basic authentication - session-based authentication methods like Devise's...

GHSA-V6FX-752R-CCP2 PgHero gem allows CSRF

The PgHero gem through 2.6.0 for Ruby allows CSRF. PgHero normally uses the protectfromforgery method from Rails to prevent CSRF. However, this defaults to :nullsession, which has no effect on non-session based authentication methods. Thus the ruby gem is vulnerable with non-session based...

PgHero gem allows CSRF

The PgHero gem through 2.6.0 for Ruby allows CSRF. PgHero normally uses the protectfromforgery method from Rails to prevent CSRF. However, this defaults to :nullsession, which has no effect on non-session based authentication methods. Thus the ruby gem is vulnerable with non-session based...

CVE-2020-16253

The PgHero gem through 2.6.0 for Ruby allows CSRF...

CVE-2020-16253

The PgHero gem through 2.6.0 for Ruby allows CSRF...

Cross site request forgery (csrf)

The PgHero gem through 2.6.0 for Ruby allows CSRF...

CVE-2020-16253

The PgHero gem through 2.6.0 for Ruby allows CSRF...

CVE-2020-16253

The PgHero gem through 2.6.0 for Ruby allows CSRF...

CVE-2020-16253

CVE-2020-16253 affects the PgHero gem for Ruby up to version 2.6.0 and is a cross-site request forgery (CSRF) vulnerability. The available connected documents consistently describe a CSRF issue in PgHero, noting that Rails’ protect_from_forgery defaults to a non-session session (null_session) whi...

PT-2020-14845

Name of the Vulnerable Software and Affected Versions PgHero gem versions through 2.6.0 Description The issue allows CSRF attacks. Normally, PgHero uses the protect from forgery method from Rails to prevent CSRF, but this defaults to :null session, which has no effect on non-session based...

CVE-2020-16253: Cross-Site Request Forgery (CSRF)

The PgHero gem through 2.6.0 for Ruby allows CSRF...

CSRF Vulnerability with Non-Session Based Authentication

The PgHero dashboard is vulnerable to CSRF with non-session based authentication methods. Impact The PgHero dashboard is vulnerable to cross-site request forgery CSRF. This affects the Docker image, Linux packages, and in specific cases, the Ruby gem. The Ruby gem is vulnerable with non-session...

Omise: Found Origin IP's Lead To Access To [ Grafana Instance , PgHero Instance [ Can SQL Injection ]

Hello through RECON for on go.exchange i found origin ip's on https://censys.io/ipv4?q=go.exchange That's allow to the attacker to access to Many Instances Like Grafana But Need Crediantles And Access To PgHero and TokenModel · GO.Exchange where the attacker can use pghero to Execute postgresql...