[SECURITY] Fedora 42 Update: pgbouncer-1.24.1-2.fc42

pgbouncer is a lightweight connection pooler for PostgreSQL and uses libevent for low-level socket handling...

[SECURITY] Fedora 40 Update: pgbouncer-1.24.1-2.fc40

pgbouncer is a lightweight connection pooler for PostgreSQL and uses libevent for low-level socket handling...

[SECURITY] Fedora 41 Update: pgbouncer-1.24.1-2.fc41

pgbouncer is a lightweight connection pooler for PostgreSQL and uses libevent for low-level socket handling...

K000150987: PostgreSQL pgAdmin vulnerabilities CVE-2025-2945 and CVE-2025-2946

Security Advisory Description CVE-2025-2945 Remote Code Execution security vulnerability in pgAdmin 4 Query Tool and Cloud Deployment modules. The vulnerability is associated with the 2 POST endpoints; /sqleditor/querytool/download, where the querycommited parameter and /cloud/deploy endpoint,...

PgBouncer default auth_query does not take Postgres password expiry into account

...

CVE-2025-1731

An incorrect permission assignment vulnerability in the PostgreSQL commands of the Zyxel USG FLEX H series uOS firmware versions from V1.20 through V1.31 could allow an authenticated local attacker with low privileges to gain access to the Linux shell and escalate their privileges by crafting...

CVE-2025-1731

An incorrect permission assignment vulnerability in the PostgreSQL commands of the Zyxel USG FLEX H series uOS firmware versions from V1.20 through V1.31 could allow an authenticated local attacker with low privileges to gain access to the Linux shell and escalate their privileges by crafting...

CVE-2025-1731

An incorrect permission assignment vulnerability in the PostgreSQL commands of the Zyxel USG FLEX H series uOS firmware versions from V1.20 through V1.31 could allow an authenticated local attacker with low privileges to gain access to the Linux shell and escalate their privileges by crafting...

CVE-2025-1731

An incorrect permission assignment vulnerability in the PostgreSQL commands of the Zyxel USG FLEX H series uOS firmware versions from V1.20 through V1.31 could allow an authenticated local attacker with low privileges to gain access to the Linux shell and escalate their privileges by crafting...

CVE-2025-1731

CVE-2025-1731 concerns Zyxel USG FLEX H series devices running uOS 1.20–1.31. The issue is an incorrect permission assignment in the PostgreSQL command handling, which could let an authenticated local attacker with low privileges gain access to the Linux shell and escalate privileges by crafting ...

PT-2025-36229

Уязвимость плагина pgCodeKeeper СУБД PostgreSQL связана с недостатками механизма десериализации в методе «deserialize» класса «Utils». Эксплуатация уязвимости может позволить нарушителю, выполнить произвольный код путём специально сформированного файла с расширением «.ser»...

Zyxel USG FLEX security vulnerabilities

Zyxel USG FLEX is a firewall from China Hopkins Zyxel. Offering flexible VPN options IPsec, SSL or L2TP, it provides flexible and secure remote access for remote work and management. A security vulnerability exists in Zyxel USG FLEX versions prior to V1.32, which stems from improper assignment of...

PT-2025-36230

Уязвимость плагина pgCodeKeeper СУБД PostgreSQL связана с незашифрованным хранением критичной информации. Эксплуатация уязвимости может позволить нарушителю раскрыть защищаемую информацию...

pgCodeKeeper Plugin Code Execution

The vulnerability of the pgCodeKeeper plugin for the PostgreSQL database is related to deficiencies in the deserialization mechanism in the “deserialize” method of the “Utils” class. Exploiting this vulnerability allows an attacker to execute arbitrary code through a specially crafted file with t...

pgCodeKeeper Plugin Information Disclosure

The vulnerability of the pgCodeKeeper plugin for the PostgreSQL database is related to the unencrypted storage of critical information. Exploiting this vulnerability could allow an attacker to disclose the protected data...

CVE-2025-1731: Incorrect Permission Assignment for Critical Resource

An incorrect permission assignment vulnerability in the PostgreSQL commands of the Zyxel USG FLEX H series uOS firmware versions from V1.20 through V1.31 could allow an authenticated local attacker with low privileges to gain access to the Linux shell and escalate their privileges by crafting...

K000150943: PostgreSQL vulnerabilities CVE-2019-10164, CVE-2020-14349, and CVE-2020-14350

Security Advisory Description CVE-2019-10164 PostgreSQL versions 10.x before 10.9 and versions 11.x before 11.4 are vulnerable to a stack-based buffer overflow. Any authenticated user can overflow a stack-based buffer by changing the user's own password to a purpose-crafted value. This often...

[R1] Stand-alone Security Patch Available for Tenable Security Center version 6.5.1: SC-202504.3

R1 Stand-alone Security Patch Available for Tenable Security Center version 6.5.1: SC-202504.3 Arnie Cabral Mon, 04/21/2025 - 11:03 Security Center leverages third-party software to help provide underlying functionality. One of the third-party components postgresql was found to contain...

PT-2025-17479

Name of the Vulnerable Software and Affected Versions USG FLEX H series uOS firmware versions from V1.20 through V1.31 Description An incorrect permission assignment vulnerability in the PostgreSQL commands could allow an authenticated local attacker with low privileges to gain access to the Linu...

RHEL 7 : postgresql (RHSA-2025:3978)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:3978 advisory. PostgreSQL is an advanced object-relational database management system DBMS. Security Fixes: postgresql: PostgreSQL quoting APIs miss neutralizing...