PO
Database
PostgreSQL
212
CVEs
0
On KEV
9.8
Max CVSS
1
New 30D
Severity mix
Critical 8High 76Medium 40Low 8
Watch
Add PostgreSQL to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2012-1618 | – | Oct 6 | Interaction error in the PostgreSQL JDBC driver before 8.2, when used with a PostgreSQL server with the "standard_conforming_strings" option enabled, such as the default… Affected: 9.1 |
| CVE-2012-3488 | – | Oct 3 | The libxslt support in contrib/xml2 in PostgreSQL 8.3 before 8.3.20, 8.4 before 8.4.13, 9.0 before 9.0.9, and 9.1 before 9.1.5 does not properly restrict access to files and URLs,… Affected: 9.1; 9.1.1; 9.1.2; 9.1.3; 9.1.4; 8.4; +34 more |
| CVE-2012-2655 | – | Jul 18 | PostgreSQL 8.3.x before 8.3.19, 8.4.x before 8.4.12, 9.0.x before 9.0.8, and 9.1.x before 9.1.4 allows remote authenticated users to cause a denial of service (server crash) by… Affected: 8.3; 8.3.1; 8.3.2; 8.3.3; 8.3.4; 8.3.5; +34 more |
| CVE-2012-0868 | – | Jul 18 | CRLF injection vulnerability in pg_dump in PostgreSQL 8.3.x before 8.3.18, 8.4.x before 8.4.11, 9.0.x before 9.0.7, and 9.1.x before 9.1.3 allows user-assisted remote attackers to… Affected: 8.3; 8.3.1; 8.3.2; 8.3.3; 8.3.4; 8.3.5; +33 more |
| CVE-2012-0867 | – | Jul 18 | PostgreSQL 8.4.x before 8.4.11, 9.0.x before 9.0.7, and 9.1.x before 9.1.3 truncates the common name to only 32 characters when verifying SSL certificates, which allows remote… Affected: 8.4; 8.4.1; 8.4.2; 8.4.3; 8.4.4; 8.4.5; +15 more |
| CVE-2012-0866 | – | Jul 18 | CREATE TRIGGER in PostgreSQL 8.3.x before 8.3.18, 8.4.x before 8.4.11, 9.0.x before 9.0.7, and 9.1.x before 9.1.3 does not properly check the execute permission for trigger… Affected: 8.3; 8.3.1; 8.3.2; 8.3.3; 8.3.4; 8.3.5; +33 more |
| CVE-2012-2143 | – | Jul 5 | The crypt_des (aka DES-based crypt) function in FreeBSD before 9.0-RELEASE-p2, as used in PHP, PostgreSQL, and other products, does not process the complete cleartext password if… Affected: 8.3 before 8.3.19; 8.4 before 8.4.12; 9.0 before 9.0.8; 9.1 before 9.1.4 |
| CVE-2011-2483 | – | Aug 25 | crypt_blowfish before 1.1, as used in PHP before 5.3.7 on certain platforms, PostgreSQL before 8.4.9, and other products, does not properly handle 8-bit characters, which makes it… Affected: 8.2.0 before 8.2.22; 8.3.0 before 8.3.16; 8.4.0 before 8.4.9; 9.0.0 before 9.0.5 |
| CVE-2010-4015 | – | Feb 2 | Buffer overflow in the gettoken function in contrib/intarray/_int_bool.c in the intarray array module in PostgreSQL 9.0.x before 9.0.3, 8.4.x before 8.4.7, 8.3.x before 8.3.14,… Affected: 8.3; 8.3.1; 8.3.2; 8.3.3; 8.3.4; 8.3.5; +34 more |
| CVE-2010-3433 | – | Oct 6 | The PL/perl and PL/Tcl implementations in PostgreSQL 7.4 before 7.4.30, 8.0 before 8.0.26, 8.1 before 8.1.22, 8.2 before 8.2.18, 8.3 before 8.3.12, 8.4 before 8.4.5, and 9.0… Affected: 7.4; 7.4.1; 7.4.2; 7.4.3; 7.4.4; 7.4.5; +34 more |
| CVE-2010-1975 | – | May 19 | PostgreSQL 7.4 before 7.4.29, 8.0 before 8.0.25, 8.1 before 8.1.21, 8.2 before 8.2.17, 8.3 before 8.3.11, and 8.4 before 8.4.4 does not properly check privileges during certain… Affected: 7.4; 7.4.1; 7.4.2; 7.4.3; 7.4.4; 7.4.5; +34 more |
| CVE-2010-1447 | – | May 19 | The Safe (aka Safe.pm) module 2.26, and certain earlier versions, for Perl, as used in PostgreSQL 7.4 before 7.4.29, 8.0 before 8.0.25, 8.1 before 8.1.21, 8.2 before 8.2.17, 8.3… Affected: 7.4; 7.4.1; 7.4.2; 7.4.3; 7.4.4; 7.4.5; +34 more |
| CVE-2010-1170 | – | May 19 | The PL/Tcl implementation in PostgreSQL 7.4 before 7.4.29, 8.0 before 8.0.25, 8.1 before 8.1.21, 8.2 before 8.2.17, 8.3 before 8.3.11, 8.4 before 8.4.4, and 9.0 Beta before 9.0… Affected: 7.4; 7.4.1; 7.4.2; 7.4.3; 7.4.4; 7.4.5; +34 more |
| CVE-2010-1169 | – | May 19 | PostgreSQL 7.4 before 7.4.29, 8.0 before 8.0.25, 8.1 before 8.1.21, 8.2 before 8.2.17, 8.3 before 8.3.11, 8.4 before 8.4.4, and 9.0 Beta before 9.0 Beta 2 does not properly… Affected: 7.4; 7.4.1; 7.4.2; 7.4.3; 7.4.4; 7.4.5; +34 more |
| CVE-2010-0733 | – | Mar 19 | Integer overflow in src/backend/executor/nodeHash.c in PostgreSQL 8.4.1 and earlier, and 8.5 through 8.5alpha2, allows remote authenticated users to cause a denial of service… Affected: through 8.4.1; 8.0; 8.0.0; 8.0.1; 8.0.2; 8.0.3; +34 more |
| CVE-2010-0442 | – | Feb 2 | The bitsubstr function in backend/utils/adt/varbit.c in PostgreSQL 8.0.23, 8.1.11, and 8.3.8 allows remote authenticated users to cause a denial of service (daemon crash) or have… Affected: 7.4 before 7.4.28; 8.0 before 8.0.24; 8.1 before 8.1.20; 8.2 before 8.2.16; 8.3 before 8.3.10; 8.4 before 8.4.3 |
| CVE-2009-4136 | – | Dec 15 | PostgreSQL 7.4.x before 7.4.27, 8.0.x before 8.0.23, 8.1.x before 8.1.19, 8.2.x before 8.2.15, 8.3.x before 8.3.9, and 8.4.x before 8.4.2 does not properly manage session-local… Affected: 7.4.1; 7.4.2; 7.4.3; 7.4.4; 7.4.5; 7.4.6; +34 more |
| CVE-2009-4034 | – | Dec 15 | PostgreSQL 7.4.x before 7.4.27, 8.0.x before 8.0.23, 8.1.x before 8.1.19, 8.2.x before 8.2.15, 8.3.x before 8.3.9, and 8.4.x before 8.4.2 does not properly handle a '\0' character… Affected: 7.4.1; 7.4.2; 7.4.3; 7.4.4; 7.4.5; 7.4.6; +34 more |
| CVE-2009-3231 | – | Sep 17 | The core server component in PostgreSQL 8.3 before 8.3.8 and 8.2 before 8.2.14, when using LDAP authentication with anonymous binds, allows remote attackers to bypass… Affected: 8.2 before 8.2.14; 8.3 before 8.3.8 |
| CVE-2009-3230 | – | Sep 17 | The core server component in PostgreSQL 8.4 before 8.4.1, 8.3 before 8.3.8, 8.2 before 8.2.14, 8.1 before 8.1.18, 8.0 before 8.0.22, and 7.4 before 7.4.26 does not use the… Affected: 7.4; 7.4.1; 7.4.2; 7.4.3; 7.4.4; 7.4.5; +34 more |
| CVE-2009-3229 | – | Sep 17 | The core server component in PostgreSQL 8.4 before 8.4.1, 8.3 before 8.3.8, and 8.2 before 8.2.14 allows remote authenticated users to cause a denial of service (backend shutdown)… Affected: 8.2; 8.2.1; 8.2.2; 8.2.3; 8.2.4; 8.2.5; +17 more |
| CVE-2009-0922 | – | Mar 17 | PostgreSQL before 8.3.7, 8.2.13, 8.1.17, 8.0.21, and 7.4.25 allows remote authenticated users to cause a denial of service (stack consumption and crash) by triggering a failure in… Affected: 7.4.24; 8.0.20; 8.1.16; 8.2.12; 8.3.6 |
| CVE-2007-6601 | – | Jan 9 | The DBLink module in PostgreSQL 8.2 before 8.2.6, 8.1 before 8.1.11, 8.0 before 8.0.15, 7.4 before 7.4.19, and 7.3 before 7.3.21, when local trust or ident authentication is used,… Affected: 7.3.0 before 7.3.21; 7.4.0 before 7.4.19; 8.0.0 before 8.0.15; 8.1.0 before 8.1.11; 8.2.0 before 8.2.6; 8.2 |
| CVE-2007-4769 | – | Jan 9 | The regular expression parser in TCL before 8.4.17, as used in PostgreSQL 8.2 before 8.2.6, 8.1 before 8.1.11, 8.0 before 8.0.15, and 7.4 before 7.4.19, allows remote… Affected: 7.3; 7.3.1; 7.3.2; 7.3.3; 7.3.4; 7.3.6; +34 more |
| CVE-2007-6067 | – | Jan 9 | Algorithmic complexity vulnerability in the regular expression parser in TCL before 8.4.17, as used in PostgreSQL 8.2 before 8.2.6, 8.1 before 8.1.11, 8.0 before 8.0.15, and 7.4… Affected: 7.3; 7.3.1; 7.3.2; 7.3.3; 7.3.4; 7.3.6; +34 more |
| CVE-2007-6600 | – | Jan 9 | PostgreSQL 8.2 before 8.2.6, 8.1 before 8.1.11, 8.0 before 8.0.15, 7.4 before 7.4.19, and 7.3 before 7.3.21 uses superuser privileges instead of table owner privileges for (1)… Affected: 7.3; 7.3.1; 7.3.2; 7.3.3; 7.3.4; 7.3.5; +34 more |
| CVE-2007-4772 | – | Jan 9 | The regular expression parser in TCL before 8.4.17, as used in PostgreSQL 8.2 before 8.2.6, 8.1 before 8.1.11, 8.0 before 8.0.15, and 7.4 before 7.4.19, allows context-dependent… Affected: 7.4 before 7.4.19; 8.0 before 8.0.15; 8.1 before 8.1.11; 8.2 before 8.2.6 |
| CVE-2007-3278 | – | Jun 19 | PostgreSQL 8.1 and probably later versions, when local trust authentication is enabled and the Database Link library (dblink) is installed, allows remote attackers to access… Affected: 7.3 before 7.3.21; 7.4 before 7.4.19; 8.0 before 8.0.15; 8.1 before 8.1.11; 8.2 before 8.2.6 |
| CVE-2007-3280 | – | Jun 19 | The Database Link library (dblink) in PostgreSQL 8.1 implements functions via CREATE statements that map to arbitrary libraries based on the C programming language, which allows… Affected: 8.1 |
| CVE-2007-3279 | – | Jun 19 | PostgreSQL 8.1 and probably later versions, when the PL/pgSQL (plpgsql) language has been created, grants certain plpgsql privileges to the PUBLIC domain, which allows remote… Affected: 8.1 |
| CVE-2007-2138 | – | Apr 24 | Untrusted search path vulnerability in PostgreSQL before 7.3.19, 7.4.x before 7.4.17, 8.0.x before 8.0.13, 8.1.x before 8.1.9, and 8.2.x before 8.2.4 allows remote authenticated… Affected: before 7.3.19; 7.4 before 7.4.17; 8.0 before 8.0.13; 8.1 before 8.1.9; 8.2 before 8.2.4 |
| CVE-2007-0556 | – | Feb 6 | The query planner in PostgreSQL before 8.0.11, 8.1 before 8.1.7, and 8.2 before 8.2.2 does not verify that a table is compatible with a "previously made query plan," which allows… Affected: 1.0; 1.01; 1.02; 1.09; 6.0; 6.1; +34 more |
| CVE-2007-0555 | – | Feb 6 | PostgreSQL 7.3 before 7.3.13, 7.4 before 7.4.16, 8.0 before 8.0.11, 8.1 before 8.1.7, and 8.2 before 8.2.2 allows attackers to disable certain checks for the data types of SQL… Affected: 7.3 before 7.3.18; 7.4 before 7.4.16; 8.0 before 8.0.11; 8.1 before 8.1.7; 8.2 before 8.2.2 |
| CVE-2006-5541 | – | Oct 26 | backend/parser/parse_coerce.c in PostgreSQL 7.4.1 through 7.4.14, 8.0.x before 8.0.9, and 8.1.x before 8.1.5 allows remote authenticated users to cause a denial of service (daemon… Affected: 7.4 before 7.4.14; 8.0.0 before 8.0.9; 8.1.0 before 8.1.5 |
| CVE-2006-5540 | – | Oct 26 | backend/parser/analyze.c in PostgreSQL 8.1.x before 8.1.5 allows remote authenticated users to cause a denial of service (daemon crash) via certain aggregate functions in an… Affected: 6.3.2; 6.5.3; 7.0.2; 7.0.3; 7.1; 7.1.1; +34 more |
| CVE-2006-5542 | – | Oct 26 | backend/tcop/postgres.c in PostgreSQL 8.1.x before 8.1.5 allows remote authenticated users to cause a denial of service (daemon crash) related to duration logging of V3-protocol… Affected: 8.1; 8.1.1; 8.1.2; 8.1.3; 8.1.4 |
| CVE-2006-2314 | – | May 24 | PostgreSQL 8.1.x before 8.1.4, 8.0.x before 8.0.8, 7.4.x before 7.4.13, 7.3.x before 7.3.15, and earlier versions allows context-dependent attackers to bypass SQL injection… Affected: 7.3; 7.3.1; 7.3.2; 7.3.3; 7.3.4; 7.3.5; +34 more |
| CVE-2006-2313 | – | May 24 | PostgreSQL 8.1.x before 8.1.4, 8.0.x before 8.0.8, 7.4.x before 7.4.13, 7.3.x before 7.3.15, and earlier versions allows context-dependent attackers to bypass SQL injection… Affected: 7.3; 7.3.1; 7.3.2; 7.3.3; 7.3.4; 7.3.5; +34 more |
| CVE-2006-0553 | – | Feb 14 | PostgreSQL 8.1.0 through 8.1.2 allows authenticated database users to gain additional privileges via "knowledge of the backend protocol" using a crafted SET ROLE to other database… Affected: 8.1.0; 8.1.1; 8.1.2 |
| CVE-2006-0678 | – | Feb 14 | PostgreSQL 7.3.x before 7.3.14, 7.4.x before 7.4.12, 8.0.x before 8.0.7, and 8.1.x before 8.1.3, when compiled with Asserts enabled, allows local users to cause a denial of… Affected: 7.3; 7.3.1; 7.3.2; 7.3.3; 7.3.4; 7.3.5; +30 more |
| CVE-2006-0105 | – | Jan 10 | PostgreSQL 8.0.x before 8.0.6 and 8.1.x before 8.1.2, when running on Windows, allows remote attackers to cause a denial of service (postmaster exit and no new connections) via a… Affected: 8.0; 8.0.1; 8.0.2; 8.0.3; 8.0.4; 8.0.5; +2 more |
| CVE-2005-1410 | – | May 3 | The tsearch2 module in PostgreSQL 7.4 through 8.0.x declares the (1) dex_init, (2) snb_en_init, (3) snb_ru_init, (4) spell_init, and (5) syn_init functions as "internal" even when… Affected: 7.4; 7.4.3; 7.4.5; 7.4.6; 7.4.7; 8.0; +2 more |
| CVE-2005-1409 | – | May 3 | PostgreSQL 7.3.x through 8.0.x gives public EXECUTE access to certain character conversion functions, which allows unprivileged users to call those functions with malicious… Affected: 7.2.1; 7.2.2; 7.2.3; 7.2.4; 7.2.5; 7.2.6; +22 more |
| CVE-2005-0227 | – | May 2 | PostgreSQL (pgsql) 7.4.x, 7.2.x, and other versions allows local users to load arbitrary shared libraries and execute code via the LOAD extension Affected: 7.3.0 before 7.3.9; 7.4 before 7.4.7; 8.0 before 8.0.1 |
| CVE-2005-0246 | – | May 2 | The intagg contrib module for PostgreSQL 8.0.0 and earlier allows attackers to cause a denial of service (crash) via crafted arrays Affected: 7.3.0 before 7.3.9; 7.4.0 before 7.4.7; 8.0.0 before 8.0.1 |
| CVE-2005-0247 | – | May 2 | Multiple buffer overflows in gram.y for PostgreSQL 8.0.1 and earlier may allow attackers to execute arbitrary code via (1) a large number of variables in a SQL statement being… Affected: 7.2; 7.2.1; 7.2.2; 7.2.3; 7.2.4; 7.2.5; +22 more |
| CVE-2005-0244 | – | May 2 | PostgreSQL 8.0.0 and earlier allows local users to bypass the EXECUTE permission check for functions by using the CREATE AGGREGATE command Affected: 7.2; 7.2.1; 7.2.2; 7.2.3; 7.2.4; 7.2.5; +21 more |
| CVE-2004-0977 | – | Feb 9 | The make_oidjoins_check script in PostgreSQL 7.4.5 and earlier allows local users to overwrite files via a symlink attack on temporary files Affected: 7.3.0 before 7.3.8; 7.4.0 before 7.4.6 |
| CVE-2005-0245 | – | Feb 1 | Buffer overflow in gram.y for PostgreSQL 8.0.0 and earlier may allow attackers to execute arbitrary code via a large number of arguments to a refcursor function (gram.y), which… Affected: 7.3 before 7.3.10; 7.4 before 7.4.7; 8.0 |
| CVE-2004-0547 | – | Aug 6 | Buffer overflow in the ODBC driver for PostgreSQL before 7.2.1 allows remote attackers to cause a denial of service (crash) Affected: 7.2.1 |