CVE-2024-24919-Check-Point-Remote-Access-VPN

CVE-2024-24919-Check-Point-Remote-Access-VPN CVE-2024-24919 è una vulnerabilità di lettura arbitraria di file non autenticata che può essere considerata niente di meno che una RCE completa non autenticata. Un attaccante può leggere qualsiasi file sensibile situato sull'appliance interessata con...

CVE-2026-42167 - ProFTPD mod_sql post-authentication SQLi - RCE

!/usr/bin/env python3 """ CVE-2026-42167 — ProFTPD modsql post-authentication SQL injection - RCE postauthstorrce.py --host --port 21 \ --user --password \ --shell-host --shell-port 4444 SUMMARY ------- ProFTPD's modsql logs FTP activity through user-supplied SQL. Its escaping helper isescapedtex...

Dotnetnuke < 13.3.3 Stored XSS potentially leading to host privilege escalation (GHSA-38xj-rgg3-5cjj)

According to its self-reported version, the instance of Dotnetnuke running on the remote web server is prior to 13.3.3. It is, therefore, affected by a vulnerability. - A stored cross-site scripting XSS vulnerability in the Console module could allow a Portal Administrator to execute arbitrary...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: postgresql (UTSA-2026-101894)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-101894 advisory. Time-of-check Time-of-use TOCTOU race condition in pgdump in PostgreSQL allows an object creator to execute arbitrary SQL functions as the user running pgdump, which...

CVE-2026-55769

CloudNativePG is a platform designed to manage PostgreSQL databases within Kubernetes environments. Prior to 1.28.4 and 1.29.2, CloudNativePG opened superuser connections without pinning searchpath in fillDefaultParameters in pkg/management/postgres/pool/profiles.go. A role holding DATABASE OWNER...

EUVD-2026-63687

CloudNativePG is a platform designed to manage PostgreSQL databases within Kubernetes environments. Prior to 1.28.4 and 1.29.2, CloudNativePG opened superuser connections without pinning searchpath in fillDefaultParameters in pkg/management/postgres/pool/profiles.go. A role holding DATABASE OWNER...

CVE-2026-55769 CloudNativePG: Overriding operators can lead to privilege escalation in CloudNativePG for SQL queries without a fixed `search_path`

CloudNativePG is a platform designed to manage PostgreSQL databases within Kubernetes environments. Prior to 1.28.4 and 1.29.2, CloudNativePG opened superuser connections without pinning searchpath in fillDefaultParameters in pkg/management/postgres/pool/profiles.go. A role holding DATABASE OWNER...

CVE-2026-55769

CloudNativePG (a Kubernetes operator for PostgreSQL) is vulnerable to privilege escalation to superuser in versions prior to 1.28.4 and 1.29.2 . The root cause is that superuser connections in fillDefaultParameters (pkg/management/postgres/pool/profiles.go) did not pin search_path. An attacker wi...

CVE-2026-55769 CloudNativePG: Overriding operators can lead to privilege escalation in CloudNativePG for SQL queries without a fixed `search_path`

CloudNativePG is a platform designed to manage PostgreSQL databases within Kubernetes environments. Prior to 1.28.4 and 1.29.2, CloudNativePG opened superuser connections without pinning searchpath in fillDefaultParameters in pkg/management/postgres/pool/profiles.go. A role holding DATABASE OWNER...

CVE-2026-55769 CloudNativePG: Overriding operators can lead to privilege escalation in CloudNativePG for SQL queries without a fixed `search_path`

CloudNativePG is a platform designed to manage PostgreSQL databases within Kubernetes environments. Prior to 1.28.4 and 1.29.2, CloudNativePG opened superuser connections without pinning searchpath in fillDefaultParameters in pkg/management/postgres/pool/profiles.go. A role holding DATABASE OWNER...

BIT-POSTGRESQL-2026-18408 PostgreSQL psql \unrestrict lets superuser of pg_dump origin server execute arbitrary code in psql client

Untrusted data inclusion in pgdump in PostgreSQL allows a malicious superuser of the origin server to inject arbitrary code for restore-time execution as the client operating system account running psql to restore the dump, via psql \restrict meta-command input expansion. The fix for CVE-2025-871...

BIT-POSTGRESQL-2026-15741 PostgreSQL expression deparse allows SQL injection via EXTRACT argument

SQL injection in PostgreSQL EXTRACT deparse allows an object owner to execute arbitrary SQL as a superuser via a hostile object definition. Attacks affect expression deparse consumers broadly, including pgdump, psql commands like \sf, and any similar usage in non-core tools. Versions before...

PT-2026-79988

SQL injection in PostgreSQL EXTRACT deparse allows an object owner to execute arbitrary SQL as a superuser via a hostile object definition. Attacks affect expression deparse consumers broadly, including pg dump, psql commands like sf, and any similar usage in non-core tools. Versions before...

Security Bulletin: Unauthenticated Remote Code Execution via Auto-Login Bypass and Code Validation

Summary A vulnerability allowed unauthenticated attackers to achieve remote code execution on default-configured instances. The vulnerability combined two distinct issues: an unauthenticated endpoint that issued superuser bearer tokens to any network caller, and a code validation endpoint that...

CVE-2026-40506

OpenEMR before 8.2.0 is vulnerable: the db GET parameter in standard_tables_manage.php is passed unsanitized to temp_dir_cleanup(), allowing path traversal and recursive deletion of arbitrary directories. Chaining with an open redirect in dicom_frame.php enables an unauthenticated attacker to tri...

EUVD-2026-60396

OpenEMR before 8.2.0 contains a path traversal vulnerability in the standardtablesmanage.php interface where the db GET parameter is passed without validation to tempdircleanup, which joins the value to the PHP temporary directory path and recursively deletes the resulting directory. Attackers ca...

PT-2026-76784

OpenEMR before 8.2.0 contains a path traversal vulnerability in the standard tables manage.php interface where the db GET parameter is passed without validation to temp dir cleanup, which joins the value to the PHP temporary directory path and recursively deletes the resulting directory. Attacker...

CVE-2026-40506: Improper Limitation of a Pathname to a Restricted Directory

OpenEMR before 8.2.0 contains a path traversal vulnerability in the standardtablesmanage.php interface where the db GET parameter is passed without validation to tempdircleanup, which joins the value to the PHP temporary directory path and recursively deletes the resulting directory. Attackers ca...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: postgresql (UTSA-2026-099513)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099513 advisory. Symlink following in PostgreSQL pgbasebackup plain format and in pgrewind allows an origin superuser to overwrite local files, e.g. /var/lib/postgres/.bashrc, that...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: postgresql (UTSA-2026-099467)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099467 advisory. Use of inherently dangerous function PQfn..., resultisint=0, ... in PostgreSQL libpq loexport, loread, lolseek64, and lotell64 functions allows the server superuser ...