14714 matches found
PostgreSQL -- PL/Perl environment variable changes execute arbitrary code
PostgreSQL project reports: Incorrect control of environment variables in PostgreSQL PL/Perl allows an unprivileged database user to change sensitive process environment variables e.g. PATH. That often suffices to enable arbitrary code execution, even if the attacker lacks a database server...
Vulnerability in core server (CVE-2024-10976)
PostgreSQL row security below e.g. subqueries disregards user ID changes Incomplete tracking in PostgreSQL of tables with row security allows a reused query to view or change different rows from those intended. CVE-2023-2455 and CVE-2016-2193 fixed most interaction between row security and user I...
Vulnerability in client (CVE-2024-10977)
PostgreSQL libpq retains an error message from man-in-the-middle Client use of server error message in PostgreSQL allows a server not trusted under current SSL or GSS settings to furnish arbitrary non-NUL bytes to the libpq application. For example, a man-in-the-middle attacker could send a long...
How to Migrate the Configuration and Repository Cache Databases
Article Applicability This article is intended for use in environments where Veeam Backup for Microsoft 365 8 is already installed. The information provided in this article outlines the process for migrating the Configuration and Cache Databases from one PostgreSQL instance to another, including...
PT-2024-8138
Name of the Vulnerable Software and Affected Versions: PostgreSQL versions prior to 17.1 PostgreSQL versions prior to 16.5 PostgreSQL versions prior to 15.9 PostgreSQL versions prior to 14.14 PostgreSQL versions prior to 13.17 PostgreSQL versions prior to 12.21 Description: The issue is related t...
FreeBSD : PostgreSQL -- PL/Perl environment variable changes execute arbitrary code (a03636f4-a29f-11ef-af48-6cc21735f730)
The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the a03636f4-a29f-11ef-af48-6cc21735f730 advisory. PostgreSQL project reports: Incorrect control of environment variables in PostgreSQL PL/Perl allows an...
Vulnerability in core server (CVE-2024-10978)
PostgreSQL SET ROLE, SET SESSION AUTHORIZATION reset to wrong user ID Incorrect privilege assignment in PostgreSQL allows a less-privileged application user to view or change different rows from those intended. An attack requires the application to use SET ROLE, SET SESSION AUTHORIZATION, or an...
KLA77143 Multiple vulnerabilities in PostgreSQL
Multiple vulnerabilities were found in PostgreSQL. Malicious users can exploit these vulnerabilities to gain privileges, bypass security restrictions, execute arbitrary code. Below is a complete list of vulnerabilities: 1. An elevation of privilege vulnerability can be exploited remotely to gain...
PostgreSQL -- SET ROLE, SET SESSION AUTHORIZATION reset to wrong user ID
PostgreSQL project reports: Incorrect privilege assignment in PostgreSQL allows a less-privileged application user to view or change different rows from those intended. An attack requires the application to use SET ROLE, SET SESSION AUTHORIZATION, or an equivalent feature. The problem arises when...
PostgreSQL -- PostgreSQL row security below e.g. subqueries disregards user ID changes
PostgreSQL project reports: Incomplete tracking in PostgreSQL of tables with row security allows a reused query to view or change different rows from those intended. CVE-2023-2455 and CVE-2016-2193 fixed most interaction between row security and user ID changes. They missed cases where a subquery...
CVE-2024-49042
Azure Database for PostgreSQL Flexible Server Extension Elevation of Privilege Vulnerability...
CVE-2024-49042
Azure Database for PostgreSQL Flexible Server Extension Elevation of Privilege Vulnerability...
CVE-2024-43613
Azure Database for PostgreSQL Flexible Server Extension Elevation of Privilege Vulnerability...
CVE-2024-43613
Azure Database for PostgreSQL Flexible Server Extension Elevation of Privilege Vulnerability...
CVE-2024-43613 Azure Database for PostgreSQL Flexible Server Extension Elevation of Privilege Vulnerability
...
CVE-2024-43613
CVE-2024-43613 affects Azure Database for PostgreSQL Flexible Server. Connected PT-security data indicates an elevation of privilege vulnerability tied to a failure to properly clean up data at the management level, enabling a remote attacker to elevate privileges within Flexible Server. The Azur...
CVE-2024-43613 Azure Database for PostgreSQL Flexible Server Extension Elevation of Privilege Vulnerability
...
CVE-2024-49042
CVE-2024-49042 concerns an elevation-of-privilege vulnerability in Azure Database for PostgreSQL Flexible Server . The connected documents describe a vulnerability in the Flexible Server component and note a failure in proper cleanup at the management level, enabling privilege escalation. Some so...