CVE-2024-10976

Incomplete tracking in PostgreSQL of tables with row security allows a reused query to view or change different rows from those intended. CVE-2023-2455 and CVE-2016-2193 fixed most interaction between row security and user ID changes. They missed cases where a subquery, WITH query, security invok...

CVE-2024-10976

Incomplete tracking in PostgreSQL of tables with row security allows a reused query to view or change different rows from those intended. CVE-2023-2455 and CVE-2016-2193 fixed most interaction between row security and user ID changes. They missed cases where a subquery, WITH query, security invok...

CVE-2024-10978

creationtimestamp| type| source ---|---|--- 2024-11-14 13:05:05+00:00| seen| https://infosec.exchange/users/cve/statuses/113481449786170984 2024-11-14 14:59:03+00:00| seen| https://t.me/cvedetector/10945 2025-02-20 23:26:54+00:00| seen| Telegram/ZWgJLSHDidKsbED79NYRIJrHIHK98b2Y4jkgVKjeWyYZKj8...

CVE-2024-10976

CVE-2024-10976 affects PostgreSQL row security policy handling when a query is planned under one role and executed under another (e.g., via subqueries, WITH, security invoker views, or SQL-language functions referencing a table with an RLS policy). This incomplete tracking can cause policies to b...

CVE-2024-10976 PostgreSQL row security below e.g. subqueries disregards user ID changes

Incomplete tracking in PostgreSQL of tables with row security allows a reused query to view or change different rows from those intended. CVE-2023-2455 and CVE-2016-2193 fixed most interaction between row security and user ID changes. They missed cases where a subquery, WITH query, security invok...

CVE-2024-10976 PostgreSQL row security below e.g. subqueries disregards user ID changes

Incomplete tracking in PostgreSQL of tables with row security allows a reused query to view or change different rows from those intended. CVE-2023-2455 and CVE-2016-2193 fixed most interaction between row security and user ID changes. They missed cases where a subquery, WITH query, security invok...

CVE-2024-10976

Incomplete tracking in PostgreSQL of tables with row security allows a reused query to view or change different rows from those intended. CVE-2023-2455 and CVE-2016-2193 fixed most interaction between row security and user ID changes. They missed cases where a subquery, WITH query, security invok...

CVE-2024-10976

Incomplete tracking in PostgreSQL of tables with row security allows a reused query to view or change different rows from those intended. CVE-2023-2455 and CVE-2016-2193 fixed most interaction between row security and user ID changes. They missed cases where a subquery, WITH query, security invok...

CVE-2020-22841

creationtimestamp| type| source ---|---|--- 2024-11-14 06:08:09+00:00| seen| MISP/90eeacac-dcdc-462f-8477-ff6eb6d1eda7...

CVE-2020-22840

creationtimestamp| type| source ---|---|--- 2024-11-14 06:08:09+00:00| seen| MISP/8ab39244-bb6c-4d97-b634-dea84993158e...

PostgreSQL 安全漏洞

PostgreSQL is a free object-relational database management system from the PostgreSQL organization. The system supports most of the SQL standards and provides many other features such as foreign keys, triggers, views, and more. A security vulnerability exists in PostgreSQL that stems from...

PostgreSQL -- PostgreSQL row security below e.g. subqueries disregards user ID changes

PostgreSQL project reports: Incomplete tracking in PostgreSQL of tables with row security allows a reused query to view or change different rows from those intended. CVE-2023-2455 and CVE-2016-2193 fixed most interaction between row security and user ID changes. They missed cases where a subquery...

CVE-2024-52549

creationtimestamp| type| source ---|---|--- 2024-11-13 20:55:33+00:00| seen| https://infosec.exchange/users/cve/statuses/113477637439411514 2024-11-13 22:20:22+00:00| seen| https://infosec.exchange/users/screaminggoat/statuses/113477970956610756 2024-11-13 23:05:33+00:00| seen|...

Context is King: Using API Sessions for Security Context

There’s no doubt that API security is a hot topic these days. The continued growth in API-related breaches and increase in publicized API vulnerabilities has pushed API security to the top of CISO’s lists. The tools in the market for API security still have room for improvement, of course. One of...

CVE-2024-49019

creationtimestamp| type| source ---|---|--- 2024-11-12 17:59:10+00:00| seen| https://infosec.exchange/users/screaminggoat/statuses/113471281510766374 2024-11-12 18:26:35+00:00| seen| https://www.thezdi.com/blog/2024/11/12/the-november-2024-security-update-review 2024-11-12 21:56:07+00:00| seen|...

CVE-2024-8535

creationtimestamp| type| source ---|---|--- 2024-11-12 16:21:28+00:00| seen| https://infosec.exchange/users/screaminggoat/statuses/113470897346004162 2024-11-12 21:24:48+00:00| seen| https://t.me/cvedetector/10695 2024-12-11 18:02:21+00:00| seen| https://t.me/itsecnews/4953 2024-12-16...

kernel: x86/hyperv: Disable IBT when hypercall page lacks ENDBR instruction

A compatibility issue was found between Linux and Hyper-V when Indirect Branch Tracking IBT is enabled. The Hyper-V hypercall page lacks the required ENDBR64 instruction, causing all hypercalls to fail with an exception and panic the guest...

DEBIAN-CVE-2024-50263

In the Linux kernel, the following vulnerability has been resolved: fork: only invoke khugepaged, ksm hooks if no error There is no reason to invoke these hooks early against an mm that is in an incomplete state. The change in commit d24062914837 "fork: use mtdup to duplicate maple tree in dupmma...

CVE-2024-50263

creationtimestamp| type| source ---|---|--- 2024-11-11 14:02:58+00:00| seen| https://infosec.exchange/users/cve/statuses/113464690446915585 2024-11-11 16:06:12+00:00| seen| https://t.me/cvedetector/10497...

CVE-2024-43430

creationtimestamp| type| source ---|---|--- 2024-11-11 12:29:59+00:00| seen| https://infosec.exchange/users/cve/statuses/113464324851825948 2024-11-11 12:33:05+00:00| seen| https://infosec.exchange/users/cve/statuses/113464337042501312 2024-11-11 15:15:56+00:00| seen| https://t.me/cvedetector/104...