CVSS: 9.9EPSS: 0%CPEs: 1EXPL: 1CVE-2024-9014 – OAuth2 client id and secret exposed through the web browser in pgAdmin 4
https://notcve.org/view.php?id=CVE-2024-9014
pgAdmin versions 8.11 and earlier are vulnerable to a security flaw in OAuth2 authentication. This vulnerability allows an attacker to potentially obtain the client ID and secret, leading to unauthorized access to user data. • https://github.com/EQSTLab/CVE-2024-9014 https://github.com/pgadmin-org/pgadmin4/issues/7945 • CWE-522: Insufficiently Protected Credentials •
CVSS: 7.4EPSS: 0%CPEs: 1EXPL: 0CVE-2024-6238 – pgAdmin 4 Installation Directory permission issue
https://notcve.org/view.php?id=CVE-2024-6238
pgAdmin <= 8.8 has an installation Directory permission issue. Because of this issue, attackers can gain unauthorised access to the installation directory on the Debian or RHEL 8 platforms. • https://github.com/pgadmin-org/pgadmin4/issues/7605 • CWE-276: Incorrect Default Permissions •
CVSS: 7.4EPSS: 0%CPEs: 1EXPL: 0CVE-2024-4216 – XSS vulnerability in /settings/store API response json payload in pgAdmin 4
https://notcve.org/view.php?id=CVE-2024-4216
pgAdmin <= 8.5 is affected by XSS vulnerability in /settings/store API response json payload. This vulnerability allows attackers to execute malicious script at the client end. pgAdmin <= 8.5 se ve afectado por una vulnerabilidad XSS en el payload json de respuesta API /settings/store. Esta vulnerabilidad permite a los atacantes ejecutar scripts maliciosos en el extremo del cliente. • https://github.com/pgadmin-org/pgadmin4/issues/7282 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/T2YFVCB4HCXU3FQBZ5XTWJZWSZUDNCXE • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.4EPSS: 0%CPEs: 1EXPL: 0CVE-2024-4215 – The Multi Factor Authentication bypass vulnerability in pgAdmin 4
https://notcve.org/view.php?id=CVE-2024-4215
pgAdmin <= 8.5 is affected by a multi-factor authentication bypass vulnerability. This vulnerability allows an attacker with knowledge of a legitimate account’s username and password may authenticate to the application and perform sensitive actions within the application, such as managing files and executing SQL queries, regardless of the account’s MFA enrollment status. pgAdmin <= 8.5 se ve afectado por una vulnerabilidad de omisión de autenticación multifactor. Esta vulnerabilidad permite que un atacante con conocimiento del nombre de usuario y la contraseña de una cuenta legítima pueda autenticarse en la aplicación y realizar acciones confidenciales dentro de la aplicación, como administrar archivos y ejecutar consultas SQL, independientemente del estado de inscripción en MFA de la cuenta. • https://github.com/pgadmin-org/pgadmin4/issues/7425 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/T2YFVCB4HCXU3FQBZ5XTWJZWSZUDNCXE • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 7.4EPSS: 0%CPEs: 1EXPL: 1CVE-2024-3116 – Remote Code Execution Vulnerability through the validate binary path API in pgAdmin 4
https://notcve.org/view.php?id=CVE-2024-3116
pgAdmin <= 8.4 is affected by a Remote Code Execution (RCE) vulnerability through the validate binary path API. This vulnerability allows attackers to execute arbitrary code on the server hosting PGAdmin, posing a severe risk to the database management system's integrity and the security of the underlying data. pgAdmin <= 8.4 se ve afectado por una vulnerabilidad de ejecución remota de código (RCE) a través de la API de validación de ruta binaria. Esta vulnerabilidad permite a los atacantes ejecutar código arbitrario en el servidor que aloja PGAdmin, lo que representa un grave riesgo para la integridad del sistema de gestión de la base de datos y la seguridad de los datos subyacentes. pgAdmin versions 8.4 and below are affected by a remote code execution vulnerability through the validate binary path API. This vulnerability allows attackers to execute arbitrary code on the server hosting PGAdmin, posing a severe risk to the database management system's integrity and the security of the underlying data. • https://github.com/TechieNeurons/CVE-2024-3116_RCE_in_pgadmin_8.4 https://gist.github.com/aelmokhtar/689a8be7e3bd535ec01992d8ec7b2b98 https://github.com/pgadmin-org/pgadmin4/issues/7326 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GIF5T34JTTYRGIN5YPT366BDFG6452A2 •