Vulnerabilities > Postgresql > Medium

DATE CVE VULNERABILITY TITLE RISK
2017-08-16 CVE-2017-7547 Unspecified vulnerability in Postgresql
PostgreSQL versions before 9.2.22, 9.3.18, 9.4.13, 9.5.8 and 9.6.4 are vulnerable to authorization flaw allowing remote authenticated attackers to retrieve passwords from the user mappings defined by the foreign server owners without actually having the privileges to do so.
network
low complexity
postgresql
4.0
2017-06-06 CVE-2016-0768 Improper Access Control vulnerability in Postgresql
PostgreSQL PL/Java after 9.0 does not honor access controls on large objects.
network
low complexity
postgresql CWE-284
5.0
2017-05-12 CVE-2017-7486 Information Exposure vulnerability in Postgresql
PostgreSQL versions 8.4 - 9.6 are vulnerable to information leak in pg_user_mappings view which discloses foreign server passwords to any user having USAGE privilege on the associated foreign server.
network
low complexity
postgresql CWE-200
5.0
2017-05-12 CVE-2017-7485 Missing Encryption of Sensitive Data vulnerability in Postgresql
In PostgreSQL 9.3.x before 9.3.17, 9.4.x before 9.4.12, 9.5.x before 9.5.7, and 9.6.x before 9.6.3, it was found that the PGREQUIRESSL environment variable was no longer enforcing a SSL/TLS connection to a PostgreSQL server.
4.3
2017-05-12 CVE-2017-7484 Information Exposure vulnerability in Postgresql
It was found that some selectivity estimation functions in PostgreSQL before 9.2.21, 9.3.x before 9.3.17, 9.4.x before 9.4.12, 9.5.x before 9.5.7, and 9.6.x before 9.6.3 did not check user privileges before providing information from pg_statistic, possibly leaking information.
network
low complexity
postgresql CWE-200
5.0
2016-12-09 CVE-2016-5424 Code Injection vulnerability in multiple products
PostgreSQL before 9.1.23, 9.2.x before 9.2.18, 9.3.x before 9.3.14, 9.4.x before 9.4.9, and 9.5.x before 9.5.4 might allow remote authenticated users with the CREATEDB or CREATEROLE role to gain superuser privileges via a (1) " (double quote), (2) \ (backslash), (3) carriage return, or (4) newline character in a (a) database or (b) role name that is mishandled during an administrative operation.
network
high complexity
debian postgresql CWE-94
4.6
2016-12-09 CVE-2016-5423 NULL Pointer Dereference vulnerability in multiple products
PostgreSQL before 9.1.23, 9.2.x before 9.2.18, 9.3.x before 9.3.14, 9.4.x before 9.4.9, and 9.5.x before 9.5.4 allow remote authenticated users to cause a denial of service (NULL pointer dereference and server crash), obtain sensitive memory information, or possibly execute arbitrary code via (1) a CASE expression within the test value subexpression of another CASE or (2) inlining of an SQL function that implements the equality operator used for a CASE expression involving values of different types.
network
low complexity
debian postgresql CWE-476
6.5
2016-02-17 CVE-2016-0773 Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in multiple products
PostgreSQL before 9.1.20, 9.2.x before 9.2.15, 9.3.x before 9.3.11, 9.4.x before 9.4.6, and 9.5.x before 9.5.1 allows remote attackers to cause a denial of service (infinite loop or buffer overflow and crash) via a large Unicode character range in a regular expression.
network
low complexity
postgresql canonical debian CWE-119
5.0
2015-10-26 CVE-2015-5288 Information Exposure vulnerability in Postgresql
The crypt function in contrib/pgcrypto in PostgreSQL before 9.0.23, 9.1.x before 9.1.19, 9.2.x before 9.2.14, 9.3.x before 9.3.10, and 9.4.x before 9.4.5 allows attackers to cause a denial of service (server crash) or read arbitrary server memory via a "too-short" salt.
network
low complexity
postgresql CWE-200
6.4
2015-05-28 CVE-2015-3165 Remote Denial Of Service vulnerability in PostgreSQL
Double free vulnerability in PostgreSQL before 9.0.20, 9.1.x before 9.1.16, 9.2.x before 9.2.11, 9.3.x before 9.3.7, and 9.4.x before 9.4.2 allows remote attackers to cause a denial of service (crash) by closing an SSL session at a time when the authentication timeout will expire during the session shutdown sequence.
4.3