KLA12177 Multiple vulnerabilities in PostgreSQL

Multiple vulnerabilities were found in PostgreSQL. Malicious users can exploit these vulnerabilities to obtain sensitive information, execute arbitrary code. Below is a complete list of vulnerabilities: 1. An information disclosure vulnerability can be exploited to obtain sensitive information. 2...

PT-2021-3135 · Postgresql +9 · Postgresql +9

Name of the Vulnerable Software and Affected Versions: postgresql versions prior to 13.3 postgresql versions prior to 12.7 postgresql versions prior to 11.12 postgresql versions prior to 10.17 postgresql versions prior to 9.6.22 Description: A flaw was found in postgresql that allows authenticate...

PT-2021-3134 · Unknown +10 · Postgresql +9

Name of the Vulnerable Software and Affected Versions: postgresql affected versions not specified Description: A flaw was found in postgresql. Using an INSERT ... ON CONFLICT ... DO UPDATE command on a purpose-crafted table, an authenticated database user could read arbitrary bytes of server...

PT-2021-3133 · Unknown +10 · Postgresql +9

Name of the Vulnerable Software and Affected Versions: PostgreSQL affected versions not specified Description: The issue is related to a flaw in the implementation of the UPDATE ... RETURNING command in the PostgreSQL database management system, which is associated with memory release errors. Thi...

Security Bulletin: Multiple Vulnerabilities in PostgreSQL Affect IBM Connect:Direct Web Service

Summary There are multiple vulnerabilities in PostgreSQL versions used by IBM Connect:Direct Web Service. IBM Connect:Direct Web Services has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2020-25696 DESCRIPTION: PostgreSQL could allow a remote attacker to execute arbitrary code ...

Security Bulletin: Security Bypass Vulnerability in PostgreSQL Affect IBM Connect:Direct Web Service

Summary Security bypass vulnerability in PostgreSQL versions used by IBM Connect:Direct Web Service. IBM Connect:Direct Web Services has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2020-1720 DESCRIPTION: PostgreSQL could allow a remote authenticated attacker to bypass security...

Security Bulletin: Multiple Vulnerabilities in PostgreSQL Affect IBM Connect:Direct Web Service

Summary There are multiple vulnerabilities in PostgreSQL versions used by IBM Connect:Direct Web Service. IBM Connect:Direct Web Services has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2020-14349 DESCRIPTION: PostgreSQL could allow a remote authenticated attacker to execute...

BSA-2021-1484

Security Advisory ID : BSA-2021-1484 Component : hard-coded administrator account Revision : 1.0 Brocade SANnav before version 2.1.1 uses a hard-coded administrator account with the weak password ‘passw0rd’ if a password is not provided for PostgreSQL at install-time. Affected Products Brocade...

Security Bulletin: Search path vulnerability in PostgreSQL Server bundled in IBM Robotic Process Automation with Automation Anywhere (CVE-2020-14349, CVE-2020-14350)

Summary The version of PostgreSQL server bundled with IBM Robotic Process Automation with Automation Anywhere did not properly sanitize the searchpath during logical replication. An authenticated attacker could use this flaw to execute arbitrary SQL command in the context of the user used for...

Important: Red Hat Security Advisory: postgresql security update

An update for postgresql is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability fro...

postgresql: Multiple features escape "security restricted operation" sandbox

A flaw was found in postgresql. An attacker having permission to create non-temporary objects in at least one schema can execute arbitrary SQL functions under the identity of a superuser. The highest threat from this vulnerability is to data confidentiality and integrity as well as system...

postgresql: TYPE in pg_temp executes arbitrary SQL during SECURITY DEFINER execution

A flaw was discovered in postgresql where arbitrary SQL statements can be executed given a suitable SECURITY DEFINER function. An attacker, with EXECUTE permission on the function, can execute arbitrary SQL as the owner of the function...

postgresql: Reconnection can downgrade connection security settings

A flaw was found in postgresql. If a client application that creates additional database connections only reuses the basic connection parameters while dropping security-relevant parameters, an opportunity for a man-in-the-middle attack, or the ability to observe clear-text transmissions, could...

postgresql security update

9.2.24-6 - Patch fixing BZ1741488 CVE-2019-10208 9.2.24-5 - Patch fixing CVE-2020-25694 BZ1907894 - Patch fixing CVE-2020-25695 BZ1907895...

Oracle Linux 7 : postgresql (ELSA-2021-1512)

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2021-1512 advisory. - Patch fixing BZ1741488 CVE-2019-10208 - Patch fixing CVE-2020-25694 BZ1907894 Tenable has extracted the preceding description block directly from the...

RHEL 7 : postgresql (RHSA-2021:1512)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:1512 advisory. PostgreSQL is an advanced object-relational database management system DBMS. Security Fixes: postgresql: Reconnection can downgrade connecti...

Security Bulletin: IBM Data Risk Manager is affected by multiple vulnerabilities

Summary IBM Data Risk Manager has addressed the following vulnerabilities: Vulnerability Details CVEID: CVE-2020-14803 DESCRIPTION: An unspecified vulnerability in Java SE could allow an unauthenticated attacker to obtain sensitive information resulting in a low confidentiality impact using unkno...

Huawei EulerOS: Security Advisory for postgresql (EulerOS-SA-2021-1833)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Exploit for Path Traversal in Atlassian Confluence_Server

Confluence unauthorize template injection CVE-2019-3396...

MGASA-2021-0200 Updated qtbase5 packages fix security vulnerability

QSslSocket incorrectly calls SSLshutdown in OpenSSL mid-handshake causing denial of service in TLS applications CVE-2020-13962 This update provides additionals fixes: - Check that the sizes are even representable when checking if clipping is necessary P300 - Multiply instead of shifting, The shif...