41 results · Feed
-
Low 3.1
Postgresql: merge fails to enforce update or select row security policies
A vulnerability was found in PostgreSQL with the use of the MERGE command, which fails to test new rows against row security policies defined for UPDATE and SELECT. If UPDATE and SELECT policies forbid some rows that INSERT policies do not forbid, a user coul…
-
High 7.5
Postgresql: extension script @substitutions@ within quoting allow sql injection
IN THE EXTENSION SCRIPT, a SQL Injection vulnerability was found in PostgreSQL if it uses @extowner@, @extschema@, or @extschema:...@ inside a quoting construct (dollar quoting, '', or ""). If an administrator has installed files of a vulnerable, trusted, non…
-
High 7.2
schema_element defeats protective search_path changes; It was found that certain database calls in PostgreSQL could per…
-
Medium 5.4
Row security policies disregard user ID changes after inlining; PostgreSQL could permit incorrect policies to be applie…
-
Low 3.7
In PostgreSQL, a modified, unauthenticated server can send an unterminated string during the establishment of Kerberos …
-
Unscored —CVE-2022-1552 EPSS 17%
A flaw was found in PostgreSQL. There is an issue with incomplete efforts to operate safely when a privileged user is m…
-
Unscored —
A vulnerability was found in PostgreSQL. This attack requires permission to create non-temporary objects in at least on…
-
Unscored —
When the server is configured to use trust authentication with a clientcert requirement or to use cert authentication, …
-
Unscored —
A flaw was found in postgresql. A purpose-crafted query can read arbitrary bytes of server memory. In the default confi…
-
Unscored —
A man-in-the-middle attacker can inject false responses to the client's first few queries, despite the use of SSL certi…
-
Unscored —
A flaw was found in postgresql. Using an INSERT ... ON CONFLICT ... DO UPDATE command on a purpose-crafted table, an au…
-
Unscored —
A flaw was found in postgresql. Using an UPDATE ... RETURNING command on a purpose-crafted table, an authenticated data…
-
Unscored —
A flaw was found in postgresql in versions before 13.3, before 12.7, before 11.12, before 10.17 and before 9.6.22. Whil…
-
Unscored —
An information leak was discovered in postgresql in versions before 13.2, before 12.6 and before 11.11. A user having U…
-
Unscored —
A flaw was found in PostgreSQL in versions before 13.2. This flaw allows a user with SELECT privilege on one column to …
-
Unscored —
A flaw was found in the psql interactive terminal of PostgreSQL in versions before 13.1, before 12.5, before 11.10, bef…
-
Unscored —CVE-2020-25695 EPSS 46%
A flaw was found in PostgreSQL versions before 13.1, before 12.5, before 11.10, before 10.15, before 9.6.20 and before …
-
Unscored —
A flaw was found in PostgreSQL versions before 13.1, before 12.5, before 11.10, before 10.15, before 9.6.20 and before …
-
Unscored —
It was found that some PostgreSQL extensions did not use search_path safely in their installation script. An attacker w…
-
Unscored —
It was found that PostgreSQL versions before 12.4, before 11.9 and before 10.14 did not properly sanitize the search_pa…
-
Low 3.1
A flaw was found in PostgreSQL's "ALTER ... DEPENDS ON EXTENSION", where sub-commands did not perform authorization che…
-
High 7.5
A flaw was discovered in postgresql versions 9.4.x before 9.4.24, 9.5.x before 9.5.19, 9.6.x before 9.6.15, 10.x before…
-
Low 3.1
Postgresql, versions 11.x before 11.5, is vulnerable to a memory disclosure in cross-type comparison for hashed subplan.
-
Low 3.1
A vulnerability was found in PostgreSQL versions 11.x up to excluding 11.3, 10.x up to excluding 10.8, 9.6.x up to, exc…
-
Medium 6.5
A vulnerability was found in postgresql versions 11.x prior to 11.3. Using a purpose-crafted insert to a partitioned ta…
-
High 7.5
PostgreSQL versions 10.x before 10.9 and versions 11.x before 11.4 are vulnerable to a stack-based buffer overflow. Any…
-
High 8.0
postgresql before versions 11.1, 10.6 is vulnerable to a to SQL injection in pg_upgrade and pg_dump via CREATE TRIGGER …
-
High 7.1
It was discovered that PostgreSQL versions before 10.5, 9.6.10, 9.5.14, 9.4.19, and 9.3.24 failed to properly check aut…
-
High 8.5
A vulnerability was found in libpq, the default PostgreSQL client library where libpq failed to properly reset its inte…
-
Medium 4.2
postgresql before versions 10.4, 9.6.9 is vulnerable in the adminpack extension, the pg_catalog.pg_logfile_rotate() fun…
-
Unscored —
A flaw was found in the way Postgresql allowed a user to modify the behavior of a query for other users. An attacker wi…
-
Unscored —
In postgresql 9.3.x before 9.3.21, 9.4.x before 9.4.16, 9.5.x before 9.5.11, 9.6.x before 9.6.7 and 10.x before 10.2, p…
-
Unscored —
Memory disclosure vulnerability in table partitioning was found in postgresql 10.x before 10.2, allowing an authenticat…
-
Unscored —
INSERT ... ON CONFLICT DO UPDATE commands in PostgreSQL 10.x before 10.1, 9.6.x before 9.6.6, and 9.5.x before 9.5.10 d…
-
Unscored —
Invalid json_populate_recordset or jsonb_populate_recordset function calls in PostgreSQL 10.x before 10.1, 9.6.x before…
-
Unscored —
PostgreSQL versions before 9.4.13, 9.5.8 and 9.6.4 are vulnerable to authorization flaw allowing remote authenticated a…
-
Unscored —
PostgreSQL versions before 9.2.22, 9.3.18, 9.4.13, 9.5.8 and 9.6.4 are vulnerable to authorization flaw allowing remote…
-
Unscored —CVE-2017-7546 EPSS 62%
PostgreSQL versions before 9.2.22, 9.3.18, 9.4.13, 9.5.8 and 9.6.4 are vulnerable to incorrect authentication flaw allo…
-
Unscored —
PostgreSQL versions 8.4 - 9.6 are vulnerable to information leak in pg_user_mappings view which discloses foreign serve…
-
Unscored —
In PostgreSQL 9.3.x before 9.3.17, 9.4.x before 9.4.12, 9.5.x before 9.5.7, and 9.6.x before 9.6.3, it was found that t…