GHSA-H86W-M5RM-XR33 Unescaped parameters in the PostgreSQL JDBC driver

Interaction error in the PostgreSQL JDBC driver before 8.2, when used with a PostgreSQL server with the "standardconformingstrings" option enabled, such as the default configuration of PostgreSQL 9.1, does not properly escape unspecified JDBC statement parameters, which allows remote attackers to...

Unescaped parameters in the PostgreSQL JDBC driver

Interaction error in the PostgreSQL JDBC driver before 8.2, when used with a PostgreSQL server with the "standardconformingstrings" option enabled, such as the default configuration of PostgreSQL 9.1, does not properly escape unspecified JDBC statement parameters, which allows remote attackers to...

The vulnerabilities of the Autovacuum, REINDEX, CREATE INDEX, REFRESH MATERIALIZED VIEW, CLUSTER, and pg_amcheck components of the PostgreSQL database management system allow attackers to execute arbitrary SQL functions under the user’s account.

The vulnerabilities of the Autovacuum, REINDEX, CREATE INDEX, REFRESH MATERIALIZED VIEW, CLUSTER, and pgamcheck components of the PostgreSQL database management system are related to errors that occur when one user manipulates objects for another user. Exploiting these vulnerabilities allows a...

postgresql:10 security update

10.19-2 - Add missing files into file section of server package postgresql-setup v8.6 newly provides postgresql-upgrade...

SQL Injection

postgresql is vulnerable to sql injection. The vulnerability exists incomplete efforts to operate safely when a privileged user is maintaining another user's objects which allows an attacker to inject and execute arbitrary sql functions...

PostgreSQL 10.x < 10.21, 11.x < 11.16, 12.x < 12.11, 13.x < 13.7, 14.x < 14.3 Privilege Escalation Vulnerability - Linux

PostgreSQL is prone to a privilege escalation vulnerability. SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

PostgreSQL 10.x < 10.21, 11.x < 11.16, 12.x < 12.11, 13.x < 13.7, 14.x < 14.3 Privilege Escalation Vulnerability - Windows

PostgreSQL is prone to a privilege escalation vulnerability. SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

GHSA-QFWQ-CHF4-JVWG karo Metacharacter Handling Remote Command Execution

The karo gem through 2.5.2 for Ruby allows Remote command injection via the host field. A flaw in db.rb is triggered when handling metacharacters. This may allow a remote attacker to execute arbitrary commands. In particular lines 76 and 95 as of 2014-06-01 pass unsanitized user supplied input to...

CVE-2022-1552

A flaw was found in PostgreSQL. There is an issue with incomplete efforts to operate safely when a privileged user is maintaining another user's objects. The Autovacuum, REINDEX, CREATE INDEX, REFRESH MATERIALIZED VIEW, CLUSTER, and pgamcheck commands activated relevant protections too late or no...

GHSA-837X-XWW6-7JQM PostgreSQL PL/Java Improper Privilege Management

PostgreSQL PL/Java before 1.5.0 allows remote authenticated users with USAGE permission on the public schema to alter the public schema classpath...

PostgreSQL PL/Java Improper Privilege Management

PostgreSQL PL/Java before 1.5.0 allows remote authenticated users with USAGE permission on the public schema to alter the public schema classpath...

Vulnerability fixed in PostgreSQL

The developers of PostgreSQL have fixed a vulnerability in PostgreSQL. It was found that certain commands such as Autovacuum, REINDEX, CREATE INDEX, REFRESH MATERIALIZED VIEW, CLUSTER and pgamcheck do not handle permissions correctly, allowing a user to can execute these commands outside the scop...

Debian DSA-5135-1 : postgresql-11 - security update

The remote Debian 10 host has packages installed that are affected by a vulnerability as referenced in the dsa-5135 advisory. Alexander Lakhin discovered that the autovacuum feature and multiple commands could escape the security- restricted operation sandbox. For additional information please...

Debian: Security Advisory (DSA-5136-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Debian DSA-5136-1 : postgresql-13 - security update

The remote Debian 11 host has packages installed that are affected by a vulnerability as referenced in the dsa-5136 advisory. Alexander Lakhin discovered that the autovacuum feature and multiple commands could escape the security- restricted operation sandbox. For additional information please...

Debian: Security Advisory (DSA-5135-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] [DSA 5136-1] postgresql-13 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-5136-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff May 12, 2022 https://www.debian.org/security/faq -...

[SECURITY] [DSA 5135-1] postgresql-11 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-5135-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff May 12, 2022 https://www.debian.org/security/faq -...

FreeBSD : PostgreSQL Server -- execute arbitrary SQL code as DBA user (157ce083-d145-11ec-ab9b-6cc21735f730)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 157ce083-d145-11ec-ab9b-6cc21735f730 advisory. - A flaw was found in PostgreSQL. There is an issue with incomplete efforts to operate safely when a...

AlmaLinux 8 : postgresql:10 (ALSA-2022:1830)

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2022:1830 advisory. postgresql: server processes unencrypted bytes from man-in-the-middle CVE-2021-23214 Tenable has extracted the preceding description block directly from the...