USN-6104-1 postgresql-10, postgresql-12, postgresql-14, postgresql-15 vulnerabilities

Alexander Lakhin discovered that PostgreSQL incorrectly handled certain CREATE privileges. An authenticated user could possibly use this issue to execute arbitrary code as the bootstrap supervisor. CVE-2023-2454 Wolfgang Walther discovered that PostgreSQL incorrectly handled certain row security...

SUSE SLES15: postgresql13 / postgresql13-contrib / postgresql13-devel / etc (SUSE-SU-2023:2219-1)

The remote SUSE Linux SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:2219-1 advisory. Updated to version 13.11: - CVE-2023-2454: Fixed an issue where a user having permission to create a schema could...

CVE-2023-2455

A flaw was found in PostgreSQL, which could permit incorrect policies being applied in certain cases where role-specific policies are used and a given query is planned under one role and executed under other roles. This scenario can happen under security definer functions, or when a common user a...

FreeBSD : postgresql-server -- Row security policies disregard user ID changes after inlining (4b636f50-f011-11ed-bbae-6cc21735f730)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 4b636f50-f011-11ed-bbae-6cc21735f730 advisory. - Row security policies disregard user ID changes after inliningmore details CVE-2023-2455 Note that...

SUSE SLES15: libecpg6 / libpq5 / libpq5-32bit / postgresql12 / etc (SUSE-SU-2023:2198-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:2198-1 advisory. Updated to version 12.15: - CVE-2023-2454: Fixed an issue where a user having permission to create a schema could hijack the...

SUSE SLES12: postgresql12 / postgresql12-contrib / postgresql12-devel / etc (SUSE-SU-2023:2200-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:2200-1 advisory. Updated to version 12.15: - CVE-2023-2454: Fixed an issue where a user having permission to create a schema could hijack the...

SUSE-SU-2023:2206-1 Security update for postgresql15

This update for postgresql15 fixes the following issues: Updated to version 15.3: - CVE-2023-2454: Fixed an issue where a user having permission to create a schema could hijack the privileges of a security definer function or extension script bsc1211228. - CVE-2023-2455: Fixed an issue that could...

SUSE-SU-2023:2201-1 Security update for postgresql13

This update for postgresql13 fixes the following issues: Updated to version 13.11: - CVE-2023-2454: Fixed an issue where a user having permission to create a schema could hijack the privileges of a security definer function or extension script bsc1211228. - CVE-2023-2455: Fixed an issue that coul...

SUSE-SU-2023:2200-1 Security update for postgresql12

This update for postgresql12 fixes the following issues: Updated to version 12.15: - CVE-2023-2454: Fixed an issue where a user having permission to create a schema could hijack the privileges of a security definer function or extension script bsc1211228. - CVE-2023-2455: Fixed an issue that coul...

Debian dla-3422 : libecpg-compat3 - security update

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3422 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-3422-1 [email protected]...

SUSE CVE-2023-2455

Row security policies disregard user ID changes after inlining; PostgreSQL could permit incorrect policies to be applied in certain cases where role-specific policies are used and a given query is planned under one role and then executed under other roles. This scenario can happen under security...

Debian DSA-5401-1 : postgresql-13 - security update

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5401 advisory. Two security issues were found in PostgreSQL, which may result in privilege escalation or incorrect policy enforcement. For the stable distribution bullseye, thes...

UBUNTU-CVE-2023-2455

Row security policies disregard user ID changes after inlining; PostgreSQL could permit incorrect policies to be applied in certain cases where role-specific policies are used and a given query is planned under one role and then executed under other roles. This scenario can happen under security...

postgresql-server -- Row security policies disregard user ID changes after inlining

PostgreSQL Project reports While CVE-2016-2193 fixed most interaction between row security and user ID changes, it missed a scenario involving function inlining. This leads to potentially incorrect policies being applied in cases where role-specific policies are used and a given query is planned...

PT-2023-2996 · Unknown +11 · Postgresql +10

Name of the Vulnerable Software and Affected Versions: PostgreSQL affected versions not specified Description: The issue is related to row security policies in PostgreSQL, which can be disregarded when user ID changes occur after inlining. This can lead to incorrect policies being applied,...

CVE-2023-2053

A vulnerability, which was classified as critical, has been found in Campcodes Advanced Online Voting System 1.0. Affected by this issue is some unknown functionality of the file /admin/candidatesrow.php. The manipulation of the argument id leads to sql injection. The attack may be launched...

CVE-2023-2051

A vulnerability classified as critical has been found in Campcodes Advanced Online Voting System 1.0. Affected is an unknown function of the file /admin/positionsrow.php. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been...

CVE-2023-2048

A vulnerability was found in Campcodes Advanced Online Voting System 1.0. It has been classified as critical. This affects an unknown part of the file /admin/votersrow.php. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has...

Campcodes Advanced Online Voting System SQL注入漏洞

Campcodes Advanced Online Voting System is an online voting system. A SQL injection vulnerability exists in Campcodes Advanced Online Voting System v1.0. The vulnerability stems from the lack of validation of external input SQL statements in the parameter id of the file /admin/candidatesrow.php,...

Campcodes Advanced Online Voting System SQL注入漏洞

Campcodes Advanced Online Voting System is an online voting system. Campcodes Advanced Online Voting System v1.0 is vulnerable to SQL injection. The vulnerability stems from the lack of validation of external input SQL statements in the parameter id of the file /admin/votersrow.php, which can be...