CVSS: 10.0EPSS: 0%CPEs: 66EXPL: 0CVE-2013-1902
https://notcve.org/view.php?id=CVE-2013-1902
PostgreSQL, 9.2.x before 9.2.4, 9.1.x before 9.1.9, 9.0.x before 9.0.13, 8.4.x before 8.4.17, and 8.3.x before 8.3.23 generates insecure temporary files with predictable filenames, which has unspecified impact and attack vectors related to "graphical installers for Linux and Mac OS X." PostgreSQL, v9.2.x anterior a v9.2.4, v9.1.x anterior a v9.1.9, v9.0.x anterior a v9.0.13, v8.4.x anterior a v8.4.17, y v8.3.x anterior a v8.3.23 genera archivos temporales inseguros con nombres predecibles, lo cual tiene un impacto no especificado y vectores de ataque similares a "instaladores gráficos para Linux y Mac OS X." • http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html http://www.postgresql.org/about/news/1456 http://www.postgresql.org/support/security •
CVSS: 10.0EPSS: 0%CPEs: 66EXPL: 0CVE-2013-1903
https://notcve.org/view.php?id=CVE-2013-1903
PostgreSQL, possibly 9.2.x before 9.2.4, 9.1.x before 9.1.9, 9.0.x before 9.0.13, 8.4.x before 8.4.17, and 8.3.x before 8.3.23 incorrectly provides the superuser password to scripts related to "graphical installers for Linux and Mac OS X," which has unspecified impact and attack vectors. PostgreSQL, probablemente en v9.2.x anterior a v9.2.4, v9.1.x anterior a v9.1.9, v9.0.x anterior a v9.0.13, v8.4.x anterior a v8.4.17, y v8.3.x anterior a v8.3.23 proporciona incorrectamente la contraseña de superusuario a los scripts relacionados con "instaladores gráficos para Linux y Mac OS X", que tiene un impacto y vectores de ataque no especificados. • http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html http://www.postgresql.org/about/news/1456 http://www.postgresql.org/support/security • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 8.5EPSS: 0%CPEs: 48EXPL: 0CVE-2013-1900 – postgresql: Improper randomization of pgcrypto functions (requiring random seed)
https://notcve.org/view.php?id=CVE-2013-1900
PostgreSQL 9.2.x before 9.2.4, 9.1.x before 9.1.9, 9.0.x before 9.0.13, and 8.4.x before 8.4.17, when using OpenSSL, generates insufficiently random numbers, which might allow remote authenticated users to have an unspecified impact via vectors related to the "contrib/pgcrypto functions." PostgreSQL v9.2.x anterior a v9.2.4, v9.1.x anterior a v9.1.9, v9.0.x anterior a v9.0.13, y v8.4.x anterior a v8.4.17 cuando se utiliza OpenSSL, genera números insuficiente aleatorios, lo que podría permitir a usuarios remotos autenticados provocar un impacto no especificado a través de vectores relacionados con las funciones "contrib/pgcrypto". • http://lists.apple.com/archives/security-announce/2013/Sep/msg00002.html http://lists.apple.com/archives/security-announce/2013/Sep/msg00004.html http://lists.fedoraproject.org/pipermail/package-announce/2013-April/101519.html http://lists.fedoraproject.org/pipermail/package-announce/2013-April/102806.html http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00007.html http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00008.html http://lists.opensuse.org/opensuse-security-announce/2 • CWE-189: Numeric Errors •
CVSS: 6.8EPSS: 1%CPEs: 62EXPL: 0CVE-2013-0255 – postgresql: array indexing error in enum_recv()
https://notcve.org/view.php?id=CVE-2013-0255
PostgreSQL 9.2.x before 9.2.3, 9.1.x before 9.1.8, 9.0.x before 9.0.12, 8.4.x before 8.4.16, and 8.3.x before 8.3.23 does not properly declare the enum_recv function in backend/utils/adt/enum.c, which causes it to be invoked with incorrect arguments and allows remote authenticated users to cause a denial of service (server crash) or read sensitive process memory via a crafted SQL command, which triggers an array index error and an out-of-bounds read. PostgreSQL v9.2.x anteriores a v9.2.3, v9.1.x anteriores a v9.1.8, v9.0.x anteriores a v9.0.12, v8.4.x anteriores a v8.4.16, y v8.3.x anteriores a v8.3.23 no declaran correctamente la función enum_recv en backend/utils/adt/enum.c, lo cual provoca que se invoque con argumentos incorrectos y permitiendo que usuarios remotos autenticados causen una denegación de servicio (caída del servidor)o la lectura de procesos de memoria a través de un comando SQL manipulado que provoca un error de indexación del array y lectura fuera de rango. • http://lists.fedoraproject.org/pipermail/package-announce/2013-February/098586.html http://lists.opensuse.org/opensuse-updates/2013-02/msg00059.html http://lists.opensuse.org/opensuse-updates/2013-02/msg00060.html http://osvdb.org/89935 http://rhn.redhat.com/errata/RHSA-2013-1475.html http://secunia.com/advisories/51923 http://secunia.com/advisories/52819 http://securitytracker.com/id?1028092 http://www.debian.org/security/2013/dsa-2630 http://www.mandriva.com/security/advisories? • CWE-20: Improper Input Validation •
CVSS: 4.9EPSS: 0%CPEs: 47EXPL: 0CVE-2012-3488 – module): XXE by applying XSL stylesheet to the document
https://notcve.org/view.php?id=CVE-2012-3488
The libxslt support in contrib/xml2 in PostgreSQL 8.3 before 8.3.20, 8.4 before 8.4.13, 9.0 before 9.0.9, and 9.1 before 9.1.5 does not properly restrict access to files and URLs, which allows remote authenticated users to modify data, obtain sensitive information, or trigger outbound traffic to arbitrary external hosts by leveraging (1) stylesheet commands that are permitted by the libxslt security options or (2) an xslt_process feature, related to an XML External Entity (aka XXE) issue. El soporte libxslt en contrib/xml2 en PostgreSQL v8.3 anteriores a v8.3.20, v8.4 anteriores a v8.4.13, v9.0 anteriores a v9.0.9, y v9.1 anteriores a v9.1.5 no restringe el acceso de forma adecuada a ficheros y URLs, lo que permite a atacantes remotos modificar datos y obtener información sensible, o provocar tráfico fuera de los límites a host externos mediante el aprovechamiento de (1)comandos de hoja de estilo que son permitirás por la opción de seguridad de libxslt o (2) la funcionalidad xslt_process, relacionada con la funcionalidad XML External Entity (también conocida como XXE). • http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705 http://lists.apple.com/archives/security-announce/2013/Mar/msg00002.html http://lists.opensuse.org/opensuse-updates/2012-09/msg00102.html http://lists.opensuse.org/opensuse-updates/2012-10/msg00013.html http://lists.opensuse.org/opensuse-updates/2012-10/msg00024.html http://rhn.redhat.com/errata/RHSA-2012-1263.html http://rhn.redhat.com/errata/RHSA-2012-1264.html http://secunia.com/advisories/50635 http://secunia.com • CWE-264: Permissions, Privileges, and Access Controls •