Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 279

Export CSV
CVE-2019-10129

postgresql: Memory disclosure in partition routing

A vulnerability was found in postgresql versions 11.x prior to 11.3. Using a purpose-crafted insert to a partitioned table, an attacker can read arbitrary bytes of server memory. In the default configuration, any user can create a partitioned table suitable for this attack. (Exploit prerequisites are the same as for CVE-2018-1052).

CVSS 3.1 · 6.5 Medium EPSS 1.6% KEV · Not listed
Vendors
Postgresql
Products
Postgresql
CVE-2019-10128

postgresql: EnterpriseDB installer does not clear permissive ACL entries

A vulnerability was found in postgresql versions 11.x prior to 11.3. The Windows installer for EnterpriseDB-supplied PostgreSQL does not lock down the ACL of the binary installation directory or the ACL of the data directory; it keeps the inherited ACL. In the default configuration, this allows a local attacker to read arbitrary data directory files, essentially bypassing database-imposed read access limitations. In plausible non-default configurations, an attacker having both an unprivileged Windows account and an unprivileged PostgreSQL account can cause the PostgreSQL service account to execute arbitrary code.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Microsoft Postgresql
Products
Windows Postgresql
CVE-2019-10127

postgresql: BigSQL installer does not clear permissive ACL entries

A vulnerability was found in postgresql versions 11.x prior to 11.3. The Windows installer for BigSQL-supplied PostgreSQL does not lock down the ACL of the binary installation directory or the ACL of the data directory; it keeps the inherited ACL. In the default configuration, an attacker having both an unprivileged Windows account and an unprivileged PostgreSQL account can cause the PostgreSQL service account to execute arbitrary code. An attacker having only the unprivileged Windows account can read arbitrary data directory files, essentially bypassing database-imposed read access limitations. An attacker having only the unprivileged Windows account can also delete certain data directory files.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Microsoft Postgresql
Products
Windows Postgresql
CVE-2018-1058

postgresql: Uncontrolled search path element in pg_dump and other client applications

A flaw was found in the way Postgresql allowed a user to modify the behavior of a query for other users. An attacker with a user account could use this flaw to execute code with the permissions of superuser in the database. Versions 9.3 through 10 are affected.

CVSS 3.1 · 8.8 High EPSS 13.1% KEV · Not listed
Vendors
Canonical Postgresql Redhat
Products
Ubuntu Linux Postgresql Cloudforms and 2 more
CVE-2018-1053

postgresql: pg_upgrade creates file of sensitive metadata under prevailing umask

In postgresql 9.3.x before 9.3.21, 9.4.x before 9.4.16, 9.5.x before 9.5.11, 9.6.x before 9.6.7 and 10.x before 10.2, pg_upgrade creates file in current working directory containing the output of `pg_dumpall -g` under umask which was in effect when the user invoked pg_upgrade, and not under 0077 which is normally used for other temporary files. This can allow an authenticated attacker to read or modify the one file, which may contain encrypted or unencrypted database passwords. The attack is infeasible if a directory mode blocks the attacker searching the current working directory or if the prevailing umask blocks the attacker opening the file.

CVSS 3.0 · 7.0 High EPSS < 1% KEV · Not listed
Vendors
Canonical Debian Postgresql and 1 more
Products
Ubuntu Linux Debian Linux Postgresql and 3 more
CVE-2018-1052

postgresql: Memory disclosure in table partitioning

Memory disclosure vulnerability in table partitioning was found in postgresql 10.x before 10.2, allowing an authenticated attacker to read arbitrary bytes of server memory via purpose-crafted insert to a partitioned table.

CVSS 3.0 · 6.5 Medium EPSS 1.8% KEV · Not listed
Vendors
Postgresql
Products
Postgresql
CVE-2018-16850

postgresql: SQL injection in pg_upgrade and pg_dump, via CREATE TRIGGER ... REFERENCING

postgresql before versions 11.1, 10.6 is vulnerable to a to SQL injection in pg_upgrade and pg_dump via CREATE TRIGGER ... REFERENCING. Using a purpose-crafted trigger definition, an attacker can cause arbitrary SQL statements to run, with superuser privileges.

CVSS 3.1 · 9.8 Critical EPSS 5.1% KEV · Not listed
Vendors
Canonical Postgresql Redhat
Products
Ubuntu Linux Postgresql Enterprise Linux and 1 more
CVE-2018-10936

PostgreSQL: Postgres JDBC driver does not perform host name validation by default

A weakness was found in postgresql-jdbc before version 42.2.5. It was possible to provide an SSL Factory and not check the host name if a host name verifier was not provided to the driver. This could lead to a condition where a man-in-the-middle attacker could masquerade as a trusted server by providing a certificate for the wrong host, as long as it was signed by a trusted CA.

CVSS 3.0 · 8.1 High EPSS 2.9% KEV · Not listed
Vendors
Postgresql Redhat
Products
Postgresql Jdbc Driver Enterprise Linux
CVE-2018-10925

postgresql: Missing authorization and memory disclosure in INSERT ... ON CONFLICT DO UPDATE statements

It was discovered that PostgreSQL versions before 10.5, 9.6.10, 9.5.14, 9.4.19, and 9.3.24 failed to properly check authorization on certain statements involved with "INSERT ... ON CONFLICT DO UPDATE". An attacker with "CREATE TABLE" privileges could exploit this to read arbitrary bytes server memory. If the attacker also had certain "INSERT" and limited "UPDATE" privileges to a particular table, they could exploit this to update other columns in the same table.

CVSS 3.1 · 8.1 High EPSS 2.2% KEV · Not listed
Vendors
Canonical Debian Postgresql and 1 more
Products
Ubuntu Linux Debian Linux Postgresql and 2 more
CVE-2018-10915

postgresql: Certain host connection parameters defeat client-side security defenses

A vulnerability was found in libpq, the default PostgreSQL client library where libpq failed to properly reset its internal state between connections. If an affected version of libpq was used with "host" or "hostaddr" connection parameters from untrusted input, attackers could bypass client-side connection security features, obtain access to higher privileged connections or potentially cause other impact through SQL injection, by causing the PQescape() functions to malfunction. Postgresql versions before 10.5, 9.6.10, 9.5.14, 9.4.19, and 9.3.24 are affected.

CVSS 3.0 · 8.5 High EPSS 5.1% KEV · Not listed
Vendors
Canonical Debian Postgresql and 1 more
Products
Ubuntu Linux Debian Linux Postgresql and 9 more
CVE-2016-7048

postgresql: Interactive installer downloads and executes software via plain HTTP

The interactive installer in PostgreSQL before 9.3.15, 9.4.x before 9.4.10, and 9.5.x before 9.5.5 might allow remote attackers to execute arbitrary code by leveraging use of HTTP to download software.

CVSS 3.1 · 8.1 High EPSS 4.9% KEV · Not listed
Vendors
Postgresql
Products
Postgresql
CVE-2015-3167

postgresql: pgcrypto has multiple error messages for decryption with an incorrect key.

contrib/pgcrypto in PostgreSQL before 9.0.20, 9.1.x before 9.1.16, 9.2.x before 9.2.11, 9.3.x before 9.3.7, and 9.4.x before 9.4.2 uses different error responses when an incorrect key is used, which makes it easier for attackers to obtain the key via a brute force attack.

CVSS 3.1 · 7.5 High EPSS 4.1% KEV · Not listed
Vendors
Canonical Debian Postgresql and 1 more
Products
Ubuntu Linux Debian Linux Postgresql and 2 more
CVE-2015-3166

postgresql: unanticipated errors from the standard library

The snprintf implementation in PostgreSQL before 9.0.20, 9.1.x before 9.1.16, 9.2.x before 9.2.11, 9.3.x before 9.3.7, and 9.4.x before 9.4.2 does not properly handle system-call errors, which allows attackers to obtain sensitive information or have other unspecified impact via unknown vectors, as demonstrated by an out-of-memory error.

CVSS 3.1 · 9.8 Critical EPSS 4.6% KEV · Not listed
Vendors
Canonical Debian Postgresql and 1 more
Products
Ubuntu Linux Debian Linux Postgresql and 2 more
CVE-2015-0244

postgresql: loss of frontend/backend protocol synchronization after an error

PostgreSQL before 9.0.19, 9.1.x before 9.1.15, 9.2.x before 9.2.10, 9.3.x before 9.3.6, and 9.4.x before 9.4.1 does not properly handle errors while reading a protocol message, which allows remote attackers to conduct SQL injection attacks via crafted binary data in a parameter and causing an error, which triggers the loss of synchronization and part of the protocol message to be treated as a new message, as demonstrated by causing a timeout or query cancellation.

CVSS 3.1 · 9.8 Critical EPSS 4.4% KEV · Not listed
Vendors
Debian Postgresql Redhat
Products
Debian Linux Postgresql Enterprise Linux and 2 more
CVE-2015-0243

postgresql: buffer overflow flaws in contrib/pgcrypto

Multiple buffer overflows in contrib/pgcrypto in PostgreSQL before 9.0.19, 9.1.x before 9.1.15, 9.2.x before 9.2.10, 9.3.x before 9.3.6, and 9.4.x before 9.4.1 allow remote authenticated users to cause a denial of service (crash) and possibly execute arbitrary code via unspecified vectors.

CVSS 3.1 · 8.8 High EPSS 5.1% KEV · Not listed
Vendors
Debian Postgresql Redhat
Products
Debian Linux Postgresql Enterprise Linux and 2 more
CVE-2015-0242

postgresql: buffer overflow flaws in replacement *printf() functions

Stack-based buffer overflow in the *printf function implementations in PostgreSQL before 9.0.19, 9.1.x before 9.1.15, 9.2.x before 9.2.10, 9.3.x before 9.3.6, and 9.4.x before 9.4.1, when running on a Windows system, allows remote authenticated users to cause a denial of service (crash) and possibly execute arbitrary code via a floating point number with a large precision, as demonstrated by using the to_char function.

CVSS 3.1 · 8.8 High EPSS 5.1% KEV · Not listed
Vendors
Debian Microsoft Postgresql
Products
Debian Linux Windows Postgresql
CVE-2015-0241

postgresql: buffer overflow in the to_char() function

The to_char function in PostgreSQL before 9.0.19, 9.1.x before 9.1.15, 9.2.x before 9.2.10, 9.3.x before 9.3.6, and 9.4.x before 9.4.1 allows remote authenticated users to cause a denial of service (crash) or possibly execute arbitrary code via a (1) large number of digits when processing a numeric formatting template, which triggers a buffer over-read, or (2) crafted timestamp formatting template, which triggers a buffer overflow.

CVSS 3.1 · 8.8 High EPSS 5.5% KEV · Not listed
Vendors
Debian Postgresql Redhat
Products
Debian Linux Postgresql Enterprise Linux and 2 more
CVE-2014-8161

postgresql: information leak through constraint violation errors

PostgreSQL before 9.0.19, 9.1.x before 9.1.15, 9.2.x before 9.2.10, 9.3.x before 9.3.6, and 9.4.x before 9.4.1 allows remote authenticated users to obtain sensitive column values by triggering constraint violation and then reading the error message.

CVSS 3.1 · 4.3 Medium EPSS 2.5% KEV · Not listed
Vendors
Debian Postgresql Redhat
Products
Debian Linux Postgresql Enterprise Linux and 2 more