CVE-2016-10782

CVE-2016-10782 affects cPanel versions prior to 60.0.25, with a self-stored XSS in the postgres API1 listdbs. The root cause is insufficient validation of client-side data in the web application, allowing injected scripts to run when listing databases. Impact: stored XSS in affected user sessions...

CVE-2016-10782: Improper Neutralization of Input During Web Page Generation

cPanel before 60.0.25 allows self stored XSS in postgres API1 listdbs SEC-181...

PT-2019-7578

Name of the Vulnerable Software and Affected Versions cPanel versions prior to 60.0.25 Description The issue allows self-stored XSS in the postgres API1 listdbs. There is no information about the estimated number of potentially affected devices worldwide or real-world incidents where this issue w...

SQL Injection

Overview Versions of sequelize prior to 3.35.1 are vulnerable to SQL Injection. The package fails to sanitize JSON path keys in the Postgres dialect, which may allow attackers to inject SQL statements and execute arbitrary SQL queries. Recommendation Upgrade to version 3.35.1 or later. References...

SQL Injection

sequelize is vulnerable to sql injection attacks. The attacks are possible because the library does not escape the JSON path key provided by the user using postgres dialects in query-generator.js...

SQL Injection

Overview sequelize is a promise-based Node.js ORM for Postgres, MySQL, MariaDB, SQLite and Microsoft SQL Server. Affected versions of this package are vulnerable to SQL Injection due to JSON path keys not being properly sanitized in the Postgres dialect. PoC by Snyk const Sequelize =...

Password Cracker: Databases

This module uses John the Ripper or Hashcat to identify weak passwords that have been acquired from the mssqlhashdump, mysqlhashdump, postgreshashdump, or oraclehashdump modules. Passwords that have been successfully cracked are then saved as proper credentials. Due to the complexity of some of t...

PostgreSQL COPY FROM PROGRAM Command Execution

Installations running Postgres 9.3 and above have functionality which allows for the superuser and users with 'pgexecuteserverprogram' to pipe to and from an external program using COPY. This allows arbitrary command execution as though you have console access. This module attempts to create a ne...

GHSA-9C2P-JW8P-F84V SQL Injection in sequelize

Affected versions of sequelize cast arrays to strings and fail to properly escape the resulting SQL statement, resulting in a SQL injection vulnerability. Proof of Concept In Postgres, SQLite, and Microsoft SQL Server there is an issue where arrays are treated as strings and improperly escaped...

SQL Injection in sequelize

Affected versions of sequelize cast arrays to strings and fail to properly escape the resulting SQL statement, resulting in a SQL injection vulnerability. Proof of Concept In Postgres, SQLite, and Microsoft SQL Server there is an issue where arrays are treated as strings and improperly escaped...

RATELIMITED: Information Disclosure PHPpgAdmin

PHPpgAdmin is a piece of script which allows system administrators to manage their Postgres databases easily from a webUI. We had forgotten to limit access to this script, resulting in the ability for a brute-force attack to happen...

CVE-2018-15441

A vulnerability in the web framework code of Cisco Prime License Manager PLM could allow an unauthenticated, remote attacker to execute arbitrary SQL queries. The vulnerability is due to a lack of proper validation of user-supplied input in SQL queries. An attacker could exploit this vulnerabilit...

PT-2018-14484

Name of the Vulnerable Software and Affected Versions libpg query versions 10 through 1.0.2 Description A memory leak was found in the pg query raw parse function within pg query parse.c, potentially leading to a denial of service. Recommendations For libpg query versions 10 through 1.0.2, at the...

box-node-sdk (>=1.16.0, <=1.16.1), homebridge-netatmo-schaloms (>=0.2.3, <=0.2.4) +6 more potentially affected by CVE-2018-3752 via merge-options (1.0.0)

merge-options NPM version 1.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on merge-options and may be impacted: - box-node-sdk =1.16.0, =0.2.3, =0.14.0, =0.14.0, =0.14.0, =0.14.0, =0.13.1, =2.0.0, =2.0.1 Source cves: CVE-2018-3752 Source advisory:...

Security update for python-Django (moderate)

This update for python-Django to version 2.08 fixes the following issues: The following security vulnerability was fixed: - CVE-2018-14574: Fixed an redirection vulnerability in CommonMiddleware boo1102680 The following other bugs were fixed: - Fixed a regression in Django 2.0.7 that broke the...

CVE-2016-7070

A privilege escalation flaw was found in the Ansible Tower. When Tower before 3.0.3 deploys a PostgreSQL database, it incorrectly configures the trust level of postgres user. An attacker could use this vulnerability to gain admin level access to the database...

PT-2018-4976

Name of the Vulnerable Software and Affected Versions Ansible Tower versions prior to 3.0.3 Description A privilege escalation flaw was found in Ansible Tower, where it incorrectly configures the trust level of the postgres user when deploying a PostgreSQL database. This allows an attacker to gai...

openSUSE Security Update : python-Django (openSUSE-2018-914)

This update for python-Django to version 2.08 fixes the following issues : The following security vulnerability was fixed : - CVE-2018-14574: Fixed an redirection vulnerability in CommonMiddleware boo1102680 The following other bugs were fixed : - Fixed a regression in Django 2.0.7 that broke the...

postgresql: Certain host connection parameters defeat client-side security defenses

A vulnerability was found in libpq, the default PostgreSQL client library where libpq failed to properly reset its internal state between connections. If an affected version of libpq were used with "host" or "hostaddr" connection parameters from untrusted input, attackers could bypass client-side...

@keyv/postgres (>=1.0.7, <=1.0.9), keyv-postgres (>=1.0.5, <=1.0.6) +2 more potentially affected by CVE-2017-16082 via pg (>=7.1.0, <=7.1.1)

pg NPM version =7.1.0, =1.0.7, =1.0.5, =0.0.1, =0.0.3 Source cves: CVE-2017-16082 Source advisory: OSV:GHSA-WC9V-MJ63-M9G5...