https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 23:48:44 +0000 https://cve.radiocsirt.org/vuln/7paa017341 <p>ABB became aware of vulnerability in the products versions listed as affected in the advisory. The ABB S+ Engineering product versions are affected by vulnerabilities in PostgreSQL version 13.11 and earlier versions. If an attacker gains access to a site’s S+ Client Server network, they could exploit such vulnerabilities by executing arbitrary code and potentially compromising the entire system.</p> <p>ABB became aware of vulnerability in the products versions listed as affected in the advisory. The ABB S+ Engineering product versions are affected by vulnerabilities in PostgreSQL version 13.11 and earlier versions. If an attacker gains access to a site’s S+ Client Server network, they could exploit such vulnerabilities by executing arbitrary code and potentially compromising the entire system.</p> https://cve.radiocsirt.org/vuln/7paa017341 https://cve.radiocsirt.org/vuln/alsa-2024:5927 <p><strong>Affected:</strong> AlmaLinux:8: pg_repack, AlmaLinux:8: pgaudit, AlmaLinux:8: postgres-decoderbufs, AlmaLinux:8: postgresql, AlmaLinux:8: postgresql-contrib, AlmaLinux:8: postgresql-docs, AlmaLinux:8: postgresql-plperl, AlmaLinux:8: postgresql-plpython3, AlmaLinux:8: postgresql-pltcl, AlmaLinux:8: postgresql-private-devel and 8 more</p> <p>PostgreSQL is an advanced object-relational database management system (DBMS).</p> <p>Security Fix(es):</p> <p>* postgresql: PostgreSQL pg_stats_ext and pg_stats_ext_exprs lack authorization checks (CVE-2024-4317) * postgresql: PostgreSQL relation replacement during pg_dump executes arbitrary SQL (CVE-2024-7348)</p> <p>For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</p> <p><strong>Affected:</strong> AlmaLinux:8: pg_repack, AlmaLinux:8: pgaudit, AlmaLinux:8: postgres-decoderbufs, AlmaLinux:8: postgresql, AlmaLinux:8: postgresql-contrib, AlmaLinux:8: postgresql-docs, AlmaLinux:8: postgresql-plperl, AlmaLinux:8: postgresql-plpython3, AlmaLinux:8: postgresql-pltcl, AlmaLinux:8: postgresql-private-devel and 8 more</p> <p>PostgreSQL is an advanced object-relational database management system (DBMS).</p> <p>Security Fix(es):</p> <p>* postgresql: PostgreSQL pg_stats_ext and pg_stats_ext_exprs lack authorization checks (CVE-2024-4317) * postgresql: PostgreSQL relation replacement during pg_dump executes arbitrary SQL (CVE-2024-7348)</p> <p>For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</p> https://cve.radiocsirt.org/vuln/alsa-2024:5927 https://cve.radiocsirt.org/vuln/bdu:2024-06153 bdu:2024-06153 https://cve.radiocsirt.org/vuln/bdu:2024-06153 https://cve.radiocsirt.org/vuln/bell-cve-2024-7348 <p><strong>Affected:</strong> Alpaquita:23: postgresql15</p> <p><strong>Affected:</strong> Alpaquita:23: postgresql15</p> https://cve.radiocsirt.org/vuln/bell-cve-2024-7348 https://cve.radiocsirt.org/vuln/bit-postgresql-2024-7348 <p><strong>Affected:</strong> Bitnami: postgresql</p> <p>Time-of-check Time-of-use (TOCTOU) race condition in pg_dump in PostgreSQL allows an object creator to execute arbitrary SQL functions as the user running pg_dump, which is often a superuser. The attack involves replacing another relation type with a view or foreign table. The attack requires waiting for pg_dump to start, but winning the race condition is trivial if the attacker retains an open transaction. Versions before PostgreSQL 16.4, 15.8, 14.13, 13.16, and 12.20 are affected.</p> <p><strong>Affected:</strong> Bitnami: postgresql</p> <p>Time-of-check Time-of-use (TOCTOU) race condition in pg_dump in PostgreSQL allows an object creator to execute arbitrary SQL functions as the user running pg_dump, which is often a superuser. The attack involves replacing another relation type with a view or foreign table. The attack requires waiting for pg_dump to start, but winning the race condition is trivial if the attacker retains an open transaction. Versions before PostgreSQL 16.4, 15.8, 14.13, 13.16, and 12.20 are affected.</p> https://cve.radiocsirt.org/vuln/bit-postgresql-2024-7348 https://cve.radiocsirt.org/vuln/certfr-2024-avi-0664 certfr-2024-avi-0664 https://cve.radiocsirt.org/vuln/certfr-2024-avi-0664 https://cve.radiocsirt.org/vuln/cleanstart-2026-ai42483 <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> CleanStart: postgresql</p> <p>Multiple security vulnerabilities affect the postgresql package. PostgreSQL optimizer statistics allow a user to read sampled data within a view that the user cannot access. See references for individual vulnerability details.</p> <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> CleanStart: postgresql</p> <p>Multiple security vulnerabilities affect the postgresql package. PostgreSQL optimizer statistics allow a user to read sampled data within a view that the user cannot access. See references for individual vulnerability details.</p> https://cve.radiocsirt.org/vuln/cleanstart-2026-ai42483 https://cve.radiocsirt.org/vuln/euvd-2026-159569 EUVD-2026-159569 https://cve.radiocsirt.org/vuln/euvd-2026-159569 https://cve.radiocsirt.org/vuln/fkie_cve-2024-7348 <p>Time-of-check Time-of-use (TOCTOU) race condition in pg_dump in PostgreSQL allows an object creator to execute arbitrary SQL functions as the user running pg_dump, which is often a superuser. The attack involves replacing another relation type with a view or foreign table. The attack requires waiting for pg_dump to start, but winning the race condition is trivial if the attacker retains an open transaction. Versions before PostgreSQL 16.4, 15.8, 14.13, 13.16, and 12.20 are affected.</p> <p>Time-of-check Time-of-use (TOCTOU) race condition in pg_dump in PostgreSQL allows an object creator to execute arbitrary SQL functions as the user running pg_dump, which is often a superuser. The attack involves replacing another relation type with a view or foreign table. The attack requires waiting for pg_dump to start, but winning the race condition is trivial if the attacker retains an open transaction. Versions before PostgreSQL 16.4, 15.8, 14.13, 13.16, and 12.20 are affected.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2024-7348 https://cve.radiocsirt.org/vuln/ghsa-3c6g-7v4g-5xcm <p>Time-of-check Time-of-use (TOCTOU) race condition in pg_dump in PostgreSQL allows an object creator to execute arbitrary SQL functions as the user running pg_dump, which is often a superuser. The attack involves replacing another relation type with a view or foreign table. The attack requires waiting for pg_dump to start, but winning the race condition is trivial if the attacker retains an open transaction. Versions before PostgreSQL 16.4, 15.8, 14.13, 13.16, and 12.20 are affected.</p> <p>Time-of-check Time-of-use (TOCTOU) race condition in pg_dump in PostgreSQL allows an object creator to execute arbitrary SQL functions as the user running pg_dump, which is often a superuser. The attack involves replacing another relation type with a view or foreign table. The attack requires waiting for pg_dump to start, but winning the race condition is trivial if the attacker retains an open transaction. Versions before PostgreSQL 16.4, 15.8, 14.13, 13.16, and 12.20 are affected.</p> https://cve.radiocsirt.org/vuln/ghsa-3c6g-7v4g-5xcm https://cve.radiocsirt.org/vuln/icsa-26-120-06 <p>ABB became aware of vulnerability in the products versions listed as affected in the advisory. The ABB S+ Engineering product versions are affected by vulnerabilities in PostgreSQL version 13.11 and earlier versions. If an attacker gains access to a site’s S+ Client Server network, they could exploit such vulnerabilities by executing arbitrary code and potentially compromising the entire system.</p> <p>ABB became aware of vulnerability in the products versions listed as affected in the advisory. The ABB S+ Engineering product versions are affected by vulnerabilities in PostgreSQL version 13.11 and earlier versions. If an attacker gains access to a site’s S+ Client Server network, they could exploit such vulnerabilities by executing arbitrary code and potentially compromising the entire system.</p> https://cve.radiocsirt.org/vuln/icsa-26-120-06 https://cve.radiocsirt.org/vuln/msrc_cve-2024-7348 msrc_CVE-2024-7348 https://cve.radiocsirt.org/vuln/msrc_cve-2024-7348 https://cve.radiocsirt.org/vuln/oesa-2024-1977 <p><strong>Affected:</strong> openEuler:22.03-LTS-SP1: postgresql</p> <p>PostgreSQL is an advanced Object-Relational database management system (DBMS) that supports almost all SQL constructs (including transactions, subselects and user-defined types and functions). The postgresql package includes the client programs and libraries that you&amp;apos;ll need to access a PostgreSQL DBMS server. Security Fix(es): Time-of-check Time-of-use (TOCTOU) race condition in pg_dump in PostgreSQL allows an object creator to execute arbitrary SQL functions as the user running pg_dump, which is often a superuser. The attack involves replacing another relation type with a view or foreign table. The attack requires waiting for pg_dump to start, but winning the race condition is trivial if the attacker retains an open transaction. Versions before PostgreSQL 16.4, 15.8, 14.13, 13.16, and 12.20 are affected.(CVE-2024-7348)</p> <p><strong>Affected:</strong> openEuler:22.03-LTS-SP1: postgresql</p> <p>PostgreSQL is an advanced Object-Relational database management system (DBMS) that supports almost all SQL constructs (including transactions, subselects and user-defined types and functions). The postgresql package includes the client programs and libraries that you&amp;apos;ll need to access a PostgreSQL DBMS server. Security Fix(es): Time-of-check Time-of-use (TOCTOU) race condition in pg_dump in PostgreSQL allows an object creator to execute arbitrary SQL functions as the user running pg_dump, which is often a superuser. The attack involves replacing another relation type with a view or foreign table. The attack requires waiting for pg_dump to start, but winning the race condition is trivial if the attacker retains an open transaction. Versions before PostgreSQL 16.4, 15.8, 14.13, 13.16, and 12.20 are affected.(CVE-2024-7348)</p> https://cve.radiocsirt.org/vuln/oesa-2024-1977 https://cve.radiocsirt.org/vuln/opensuse-su-2024:14348-1 <p>postgresql12-12.20-1.1 on GA media</p> <p>postgresql12-12.20-1.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2024:14348-1 https://cve.radiocsirt.org/vuln/rhsa-2024:6000 <p>postgresql: PostgreSQL relation replacement during pg_dump executes arbitrary SQL</p> <p>postgresql: PostgreSQL relation replacement during pg_dump executes arbitrary SQL</p> https://cve.radiocsirt.org/vuln/rhsa-2024:6000 https://cve.radiocsirt.org/vuln/suse-su-2024:3153-1 <p>Security update for postgresql16</p> <p>Security update for postgresql16</p> https://cve.radiocsirt.org/vuln/suse-su-2024:3153-1 https://cve.radiocsirt.org/vuln/ubuntu-cve-2024-7348 <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: postgresql-9.3, Ubuntu:Pro:16.04:LTS: postgresql-9.5, Ubuntu:Pro:18.04:LTS: postgresql-10, Ubuntu:20.04:LTS: postgresql-12, Ubuntu:22.04:LTS: postgresql-14, Ubuntu:24.04:LTS: postgresql-16</p> <p>Time-of-check Time-of-use (TOCTOU) race condition in pg_dump in PostgreSQL allows an object creator to execute arbitrary SQL functions as the user running pg_dump, which is often a superuser. The attack involves replacing another relation type with a view or foreign table. The attack requires waiting for pg_dump to start, but winning the race condition is trivial if the attacker retains an open transaction. Versions before PostgreSQL 16.4, 15.8, 14.13, 13.16, and 12.20 are affected.</p> <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: postgresql-9.3, Ubuntu:Pro:16.04:LTS: postgresql-9.5, Ubuntu:Pro:18.04:LTS: postgresql-10, Ubuntu:20.04:LTS: postgresql-12, Ubuntu:22.04:LTS: postgresql-14, Ubuntu:24.04:LTS: postgresql-16</p> <p>Time-of-check Time-of-use (TOCTOU) race condition in pg_dump in PostgreSQL allows an object creator to execute arbitrary SQL functions as the user running pg_dump, which is often a superuser. The attack involves replacing another relation type with a view or foreign table. The attack requires waiting for pg_dump to start, but winning the race condition is trivial if the attacker retains an open transaction. Versions before PostgreSQL 16.4, 15.8, 14.13, 13.16, and 12.20 are affected.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2024-7348 https://cve.radiocsirt.org/vuln/wid-sec-w-2024-1800 <p>Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in PostgreSQL ausnutzen, um seine Privilegien zu erhöhen.</p> <p>Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in PostgreSQL ausnutzen, um seine Privilegien zu erhöhen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2024-1800