CVE & Exploit Intelligence Database

CVE-2019-9193 7.2 HIGH EXPLOITED 16 PoCs Analysis NUCLEI EPSS 0.93

In PostgreSQL 9.3 through 11.2, the "COPY TO/FROM PROGRAM" function allows superusers and users in the 'pg_execute_server_program' group to execute arbitrary code in the context of the database's operating system user. This functionality is enabled by default and can be abused to run arbitrary operating system commands on Windows, Linux, and macOS. NOTE: Third parties claim/state this is not an issue because PostgreSQL functionality for ‘COPY TO/FROM PROGRAM’ is acting as intended. References state that in PostgreSQL, a superuser can execute commands as the server user without using the ‘COPY FROM PROGRAM’.

CWE-78 Apr 01, 2019

CVE-2018-10936 8.1 HIGH 2 PoCs Analysis EPSS 0.01

A weakness was found in postgresql-jdbc before version 42.2.5. It was possible to provide an SSL Factory and not check the host name if a host name verifier was not provided to the driver. This could lead to a condition where a man-in-the-middle attacker could masquerade as a trusted server by providing a certificate for the wrong host, as long as it was signed by a trusted CA.

CWE-297 Aug 30, 2018

CVE-2017-14798 7.3 HIGH 1 PoC Analysis EPSS 0.01

A race condition in the postgresql init script could be used by attackers able to access the postgresql account to escalate their privileges to root.

CWE-362 Mar 01, 2018

CVE-2017-15099 6.5 MEDIUM 1 PoC Analysis EPSS 0.30

INSERT ... ON CONFLICT DO UPDATE commands in PostgreSQL 10.x before 10.1, 9.6.x before 9.6.6, and 9.5.x before 9.5.10 disclose table contents that the invoker lacks privilege to read. These exploits affect only tables where the attacker lacks full read access but has both INSERT and UPDATE privileges. Exploits bypass row level security policies and lack of SELECT privilege.

CWE-200 Nov 22, 2017

CVE-2013-1899 1 PoC Analysis EPSS 0.81

Argument injection vulnerability in PostgreSQL 9.2.x before 9.2.4, 9.1.x before 9.1.9, and 9.0.x before 9.0.13 allows remote attackers to cause a denial of service (file corruption), and allows remote authenticated users to modify configuration settings and execute arbitrary code, via a connection request using a database name that begins with a "-" (hyphen).

CWE-94 Apr 04, 2013

CVE-2010-0733 1 PoC Analysis EPSS 0.08

Integer overflow in src/backend/executor/nodeHash.c in PostgreSQL 8.4.1 and earlier, and 8.5 through 8.5alpha2, allows remote authenticated users to cause a denial of service (daemon crash) via a SELECT statement with many LEFT JOIN clauses, related to certain hashtable size calculations.

CWE-189 Mar 19, 2010

CVE-2010-0442 1 PoC Analysis EPSS 0.14

The bitsubstr function in backend/utils/adt/varbit.c in PostgreSQL 8.0.23, 8.1.11, and 8.3.8 allows remote authenticated users to cause a denial of service (daemon crash) or have unspecified other impact via vectors involving a negative integer in the third argument, as demonstrated by a SELECT statement that contains a call to the substring function for a bit string, related to an "overflow."

CWE-189 Feb 02, 2010

CVE-2009-0922 1 PoC Analysis EPSS 0.09

PostgreSQL before 8.3.7, 8.2.13, 8.1.17, 8.0.21, and 7.4.25 allows remote authenticated users to cause a denial of service (stack consumption and crash) by triggering a failure in the conversion of a localized error message to a client-specified encoding, as demonstrated using mismatched encoding conversion requests.

CWE-399 Mar 17, 2009

CVE-2007-3280 2 PoCs Analysis EPSS 0.49

The Database Link library (dblink) in PostgreSQL 8.1 implements functions via CREATE statements that map to arbitrary libraries based on the C programming language, which allows remote authenticated superusers to map and execute a function from any library, as demonstrated by using the system function in libc.so.6 to gain shell access.

Jun 19, 2007

CVE-2005-0245 1 PoC Analysis EPSS 0.23

Buffer overflow in gram.y for PostgreSQL 8.0.0 and earlier may allow attackers to execute arbitrary code via a large number of arguments to a refcursor function (gram.y), which leads to a heap-based buffer overflow, a different vulnerability than CVE-2005-0247.

Feb 01, 2005

CVE-2000-1199 1 PoC Analysis EPSS 0.01

PostgreSQL stores usernames and passwords in plaintext in (1) pg_shadow and (2) pg_pwd, which allows attackers with sufficient privileges to gain access to databases.

Aug 31, 2001