CVSS: 7.5EPSS: 1%CPEs: 40EXPL: 0CVE-2006-2314
https://notcve.org/view.php?id=CVE-2006-2314
PostgreSQL 8.1.x before 8.1.4, 8.0.x before 8.0.8, 7.4.x before 7.4.13, 7.3.x before 7.3.15, and earlier versions allows context-dependent attackers to bypass SQL injection protection methods in applications that use multibyte encodings that allow the "\" (backslash) byte 0x5c to be the trailing byte of a multibyte character, such as SJIS, BIG5, GBK, GB18030, and UHC, which cannot be handled correctly by a client that does not understand multibyte encodings, aka a second variant of "Encoding-Based SQL Injection." NOTE: it could be argued that this is a class of issue related to interaction errors between the client and PostgreSQL, but a CVE has been assigned since PostgreSQL is treating this as a preventative measure against this class of problem. • ftp://patches.sgi.com/support/free/security/advisories/20060602-01-U.asc http://archives.postgresql.org/pgsql-announce/2006-05/msg00010.php http://lists.suse.com/archive/suse-security-announce/2006-Jun/0002.html http://secunia.com/advisories/20231 http://secunia.com/advisories/20232 http://secunia.com/advisories/20314 http://secunia.com/advisories/20435 http://secunia.com/advisories/20451 http://secunia.com/advisories/20503 http://secunia.com/advisories/20555 http://secunia.c •
CVSS: 1.5EPSS: 0%CPEs: 36EXPL: 0CVE-2006-0678
https://notcve.org/view.php?id=CVE-2006-0678
PostgreSQL 7.3.x before 7.3.14, 7.4.x before 7.4.12, 8.0.x before 8.0.7, and 8.1.x before 8.1.3, when compiled with Asserts enabled, allows local users to cause a denial of service (server crash) via a crafted SET SESSION AUTHORIZATION command, a different vulnerability than CVE-2006-0553. • http://secunia.com/advisories/18890 http://secunia.com/advisories/19015 http://secunia.com/advisories/19035 http://securityreason.com/securityalert/498 http://www.openpkg.org/security/OpenPKG-SA-2006.004-postgresql.html http://www.postgresql.org/docs/8.1/static/release.html#RELEASE-8-1-3 http://www.securityfocus.com/archive/1/425037/100/0/threaded http://www.securityfocus.com/bid/16650 http://www.trustix.org/errata/2006/0008 http://www.ubuntu.com/usn/usn-258-1 http •
CVSS: 7.5EPSS: 0%CPEs: 28EXPL: 0CVE-2005-1409
https://notcve.org/view.php?id=CVE-2005-1409
PostgreSQL 7.3.x through 8.0.x gives public EXECUTE access to certain character conversion functions, which allows unprivileged users to call those functions with malicious values, with unknown impact, aka the "Character conversion vulnerability." • http://archives.postgresql.org/pgsql-announce/2005-05/msg00001.php http://www.novell.com/linux/security/advisories/2005_36_sudo.html http://www.postgresql.org/about/news.315 http://www.redhat.com/support/errata/RHSA-2005-433.html http://www.securityfocus.com/archive/1/426302/30/6680/threaded http://www.securityfocus.com/bid/13476 http://www.vupen.com/english/advisories/2005/0453 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10050 https:/& •
CVSS: 2.1EPSS: 0%CPEs: 9EXPL: 0CVE-2005-1410
https://notcve.org/view.php?id=CVE-2005-1410
The tsearch2 module in PostgreSQL 7.4 through 8.0.x declares the (1) dex_init, (2) snb_en_init, (3) snb_ru_init, (4) spell_init, and (5) syn_init functions as "internal" even when they do not take an internal argument, which allows attackers to cause a denial of service (application crash) and possibly have other impacts via SQL commands that call other functions that accept internal arguments. • http://archives.postgresql.org/pgsql-announce/2005-05/msg00001.php http://www.novell.com/linux/security/advisories/2005_36_sudo.html http://www.postgresql.org/about/news.315 http://www.redhat.com/support/errata/RHSA-2005-433.html http://www.securityfocus.com/archive/1/426302/30/6680/threaded http://www.securityfocus.com/bid/13475 http://www.vupen.com/english/advisories/2005/0453 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1086 https:/&# •
CVSS: 6.5EPSS: 0%CPEs: 27EXPL: 0CVE-2005-0244
https://notcve.org/view.php?id=CVE-2005-0244
PostgreSQL 8.0.0 and earlier allows local users to bypass the EXECUTE permission check for functions by using the CREATE AGGREGATE command. • http://archives.postgresql.org/pgsql-hackers/2005-01/msg00922.php http://marc.info/?l=bugtraq&m=110806034116082&w=2 http://secunia.com/advisories/12948 http://www.mandriva.com/security/advisories?name=MDKSA-2005:040 http://www.novell.com/linux/security/advisories/2005_36_sudo.html http://www.redhat.com/support/errata/RHSA-2005-138.html http://www.securityfocus.com/bid/12417 https://exchange.xforce.ibmcloud.com/vulnerabilities/19184 https://oval.cisecurity.org/repository/search/defini • CWE-264: Permissions, Privileges, and Access Controls •