CVSS: 7.7EPSS: 1%CPEs: 6EXPL: 0CVE-2020-13692 – postgresql-jdbc: XML external entity (XXE) vulnerability in PgSQLXML
https://notcve.org/view.php?id=CVE-2020-13692
PostgreSQL JDBC Driver (aka PgJDBC) before 42.2.13 allows XXE. PostgreSQL JDBC Driver (también se conoce como PgJDBC) versiones anteriores a 42.2.13, permite un ataque de tipo XXE A flaw was found in PostgreSQL JDBC in versions prior to 42.2.13. An XML External Entity (XXE) weakness was found in PostgreSQL JDBC. The highest threat from this vulnerability is to data confidentiality and system availability. • https://github.com/pgjdbc/pgjdbc/commit/14b62aca4764d496813f55a43d050b017e01eb65 https://jdbc.postgresql.org/documentation/changelog.html#version_42.2.13 https://lists.apache.org/thread.html/r00bcc6b2da972e0d6332a4ebc7807e17305d8b8e7fb2ae63d2a3cbfb%40%3Ccommits.camel.apache.org%3E https://lists.apache.org/thread.html/r01ae1b3d981cf2e563e9b5b0a6ea54fb3cac8e9a0512ee5269e3420e%40%3Ccommits.camel.apache.org%3E https://lists.apache.org/thread.html/r0478a1aa9ae0dbd79d8f7b38d0d93fa933ac232e2b430b6f31a103c0%40%3Ccommits.camel.apache.org%3E https://lists.apache.org/thread.html/ • CWE-611: Improper Restriction of XML External Entity Reference •
CVSS: 8.1EPSS: 0%CPEs: 3EXPL: 1CVE-2018-10936
https://notcve.org/view.php?id=CVE-2018-10936
A weakness was found in postgresql-jdbc before version 42.2.5. It was possible to provide an SSL Factory and not check the host name if a host name verifier was not provided to the driver. This could lead to a condition where a man-in-the-middle attacker could masquerade as a trusted server by providing a certificate for the wrong host, as long as it was signed by a trusted CA. Se ha descubierto una debilidad en versiones anteriores a la 42.2.5 de postgresql-jdbc. Era posible proporcionar un SSL Factory y no comprobar el nombre de host si no se ha proporcionado un verificador de nombres de host al controlador. • https://github.com/tafamace/CVE-2018-10936 http://www.securityfocus.com/bid/105220 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10936 https://lists.apache.org/thread.html/9317fd092b257a0815434b116a8af8daea6e920b6673f4fd5583d5fe%40%3Ccommits.druid.apache.org%3E https://www.postgresql.org/about/news/1883 • CWE-297: Improper Validation of Certificate with Host Mismatch •
CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 0CVE-2012-1618
https://notcve.org/view.php?id=CVE-2012-1618
Interaction error in the PostgreSQL JDBC driver before 8.2, when used with a PostgreSQL server with the "standard_conforming_strings" option enabled, such as the default configuration of PostgreSQL 9.1, does not properly escape unspecified JDBC statement parameters, which allows remote attackers to perform SQL injection attacks. NOTE: as of 20120330, it was claimed that the upstream developer planned to dispute this issue, but an official dispute has not been posted as of 20121005. Error de interacción en el controlador PostgreSQL JDBC anteriores a v8.2, cuando se usa con el servidor PostgreSQL con la opción "standard_conforming_strings" activa, como la configuración por defecto de PostgreSQL v9.1, no "escapa" de forma adecuada parámetros JDBC de declaración, lo que permite a atacantes remotos a efectuar ataques de inyección SQL. NOTA: se afirmó que el desarrollador original planeaba discutir ese punto, pero una disputa oficial no ha sido publicada a partir de 20121005. • http://archives.neohapsis.com/archives/bugtraq/2012-03/0126.html http://lists.opensuse.org/opensuse-security/2012-03/msg00024.html http://www.openwall.com/lists/oss-security/2012/03/30/8 http://www.openwall.com/lists/oss-security/2012/03/30/9 http://www.openwall.com/lists/oss-security/2012/03/31/1 http://www.openwall.com/lists/oss-security/2012/04/02/4 http://www.openwall.com/lists/oss-security/2012/04/04/11 http://www.openwall.com/lists/oss-security&#x •