14498 matches found
CVE-2021-23222 affecting package postgresql 12.8-1
CVE-2021-23222 affecting package postgresql 12.8-1. A patched version of the package is available...
Debian: Security Advisory (DSA-5101-1)
The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Network Olympus SQL Injection Vulnerability
Network Olympus is Softinventive Lab's enterprise network for agentless monitoring. Network Olympus version 1.8.0 is vulnerable to SQL injection, which stems from a missing sqlparameter JSON parameter in /api/eventinstance validation of external input SQL statements. An attacker could exploit thi...
[SECURITY] [DSA 5101-1] libphp-adodb security update
------------------------------------------------------------------------- Debian Security Advisory DSA-5101-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso March 13, 2022 https://www.debian.org/security/faq -...
Security Bulletin: Vulnerabilities in Polkit, PostgreSQL, OpenSSL, OpenSSH, and jQuery affect IBM Spectrum Copy Data Management
Summary Vulnerabilities in Polkit, PostgreSQL, OpenSSL, OpenSSH, and jQuery can affect IBM Spectrum Copy Data Management. Vulnerabilities include elevated privileges, SQL injection, obtaining sensitive information, cross-site scripting, and man-in-the-middle attacks. Vulnerability Details CVEID:...
AlmaLinux 8 : postgresql:12 (ALSA-2021:5235)
The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2021:5235 advisory. postgresql: memory disclosure in certain queries CVE-2021-3677 postgresql: server processes unencrypted bytes from man-in-the-middle CVE-2021-23214 Tenabl...
AlmaLinux 8 : postgresql:13 (ALSA-2021:5236)
The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2021:5236 advisory. postgresql: memory disclosure in certain queries CVE-2021-3677 postgresql: server processes unencrypted bytes from man-in-the-middle CVE-2021-23214 Tenabl...
Security Bulletin: IBM Spectrum Protect Plus is vulnerable to PostgreSQL Man-in-the-Middle and Slowloris Denial of Service attacks (CVE-2021-23222, CVE-2022-22354)
Summary PostgreSQL is vulnerable to a man-in-the-middle attack which can affect IBM Spectrum Protect Plus. In addition, IBM Spectrum Protect Plus is vulnerable to a Slowloris denial of service attack. Vulnerability Details CVEID: CVE-2021-23222 DESCRIPTION: PostgreSQL is vulnerable to a...
A flaw was found in postgresql. A purpose-crafted query can read arbitrary bytes of server memory. In the default configuration any authenticated database user can complete this attack at will. The attack does not require the ability to create objects. If server settings include max_worker_processes=0 the known versions of this attack are infeasible. However undiscovered variants of the attack may be independent of that setting.
...
GHSA-727H-HRW8-JG8Q Path traversal in org.postgresql:postgresql
In pgjdbc before 42.3.3, an attacker who controls the jdbc URL or properties can call java.util.logging.FileHandler to write to arbitrary files through the loggerFile and loggerLevel connection properties. An example situation is that an attacker could create an executable JSP file under a Tomcat...
CVE-2022-25225
Network Olympus version 1.8.0 allows an authenticated admin user to inject SQL queries in '/api/eventinstance' via the 'sqlparameter' JSON parameter. It is also possible to achieve remote code execution in the default installation PostgreSQL by exploiting this issue...
CVE-2022-25225
Network Olympus version 1.8.0 allows an authenticated admin user to inject SQL queries in '/api/eventinstance' via the 'sqlparameter' JSON parameter. It is also possible to achieve remote code execution in the default installation PostgreSQL by exploiting this issue...
CVE-2022-25225
Network Olympus version 1.8.0 allows an authenticated admin user to inject SQL queries in '/api/eventinstance' via the 'sqlparameter' JSON parameter. It is also possible to achieve remote code execution in the default installation PostgreSQL by exploiting this issue...
Remote code execution
Network Olympus version 1.8.0 allows an authenticated admin user to inject SQL queries in '/api/eventinstance' via the 'sqlparameter' JSON parameter. It is also possible to achieve remote code execution in the default installation PostgreSQL by exploiting this issue...
PostgreSQL JDBC Driver 安全漏洞
The PostgreSQL JDBC Driver is an open source JDBC driver written in Pure Java Type 4 for communication in the PostgreSQL native network protocol. A security vulnerability existed in PostgreSQL JDBC Driver before 42.3.3. No information about the vulnerability is available at this time, so please...
CVE-2022-25225
Network Olympus 1.8.0 is vulnerable to SQL injection in the /api/eventinstance endpoint via the sqlparameter JSON field, exploitable by an authenticated admin. The issue can also lead to remote code execution in a default PostgreSQL installation. Root cause: lack of input validation/parameter han...
CVE-2022-25225
Network Olympus version 1.8.0 allows an authenticated admin user to inject SQL queries in '/api/eventinstance' via the 'sqlparameter' JSON parameter. It is also possible to achieve remote code execution in the default installation PostgreSQL by exploiting this issue...
AZL-8973 CVE-2021-23214 affecting package postgresql for versions less than 14.2-1
When the server is configured to use trust authentication with a clientcert requirement or to use cert authentication, a man-in-the-middle attacker can inject arbitrary SQL queries when a connection is first established, despite the use of SSL certificate verification and encryption...
CVE-2021-3677
A flaw was found in postgresql. A purpose-crafted query can read arbitrary bytes of server memory. In the default configuration, any authenticated database user can complete this attack at will. The attack does not require the ability to create objects. If server settings include...
DEBIAN-CVE-2021-3677
A flaw was found in postgresql. A purpose-crafted query can read arbitrary bytes of server memory. In the default configuration, any authenticated database user can complete this attack at will. The attack does not require the ability to create objects. If server settings include...