Access Control

Every one of the 35 is a mark on the map. Named now: 1 to 26, most at risk first.

1. The validator functions for the procedural languages (PLs) in PostgreSQL before 8.4.20, 9.0.x before 9.0.16, 9.1.x before 9.1.12, 9.2.x before 9.2.7, and 9.3.x before 9.3.3 allow…CVE-2014-0061Postgresql · 4.9% likely

   CWE-264

2. The interactive installer in PostgreSQL before 9.3.15, 9.4.x before 9.4.10, and 9.5.x before 9.5.5 might allow remote attackers to execute arbitrary code by leveraging use of HTTP…CVE-2016-7048Postgresql · 4.9% likely

   CWE-284

3. PostgreSQL before 8.4.20, 9.0.x before 9.0.16, 9.1.x before 9.1.12, 9.2.x before 9.2.7, and 9.3.x before 9.3.3 does not properly enforce the ADMIN OPTION restriction, which allows…CVE-2014-0060Postgresql · 4.1% likely

   CWE-264

4. PostgreSQL before 9.1.20, 9.2.x before 9.2.15, 9.3.x before 9.3.11, 9.4.x before 9.4.6, and 9.5.x before 9.5.1 does not properly restrict access to unspecified custom configuratio…CVE-2016-0766Postgresql · 4.1% likely

   CWE-264

5. The (1) brin_page_type and (2) brin_metapage_info functions in the pageinspect extension in PostgreSQL before 9.5.x before 9.5.2 allows attackers to bypass intended access restric…CVE-2016-3065Postgresql · 4.1% likely

   CWE-264

6. postgresql before versions 10.4, 9.6.9 is vulnerable in the adminpack extension, the pg_catalog.pg_logfile_rotate() function doesn't follow the same ACLs than pg_rorate_logfile. I…CVE-2018-1115Postgresql · CVSS 4.2 · 3.8% likely

   CWE-732

7. Untrusted search path vulnerability in PostgreSQL before 7.3.19, 7.4.x before 7.4.17, 8.0.x before 8.0.13, 8.1.x before 8.1.9, and 8.2.x before 8.2.4 allows remote authenticated u…CVE-2007-2138Postgresql · 3.8% likely

   CWE-264

8. CREATE TRIGGER in PostgreSQL 8.3.x before 8.3.18, 8.4.x before 8.4.11, 9.0.x before 9.0.7, and 9.1.x before 9.1.3 does not properly check the execute permission for trigger functi…CVE-2012-0866Postgresql · 3.6% likely

   CWE-264

9. PostgreSQL versions before 9.4.13, 9.5.8 and 9.6.4 are vulnerable to authorization flaw allowing remote authenticated attackers with no privileges on a large object to overwrite t…CVE-2017-7548PostgreSQL · 3.5% likely

   CWE-862

10. The PL/perl and PL/Tcl implementations in PostgreSQL 7.4 before 7.4.30, 8.0 before 8.0.26, 8.1 before 8.1.22, 8.2 before 8.2.18, 8.3 before 8.3.12, 8.4 before 8.4.5, and 9.0 befor…CVE-2010-3433Postgresql · 3.3% likely

    CWE-264

11. PostgreSQL 9.2.x before 9.2.4 and 9.1.x before 9.1.9 does not properly check REPLICATION privileges, which allows remote authenticated users to bypass intended backup restrictions…CVE-2013-1901Postgresql · 3.3% likely

    CWE-264

12. The libxslt support in contrib/xml2 in PostgreSQL 8.3 before 8.3.20, 8.4 before 8.4.13, 9.0 before 9.0.9, and 9.1 before 9.1.5 does not properly restrict access to files and URLs,…CVE-2012-3488Postgresql · 3.3% likely

    CWE-264

13. PostgreSQL 8.2 before 8.2.6, 8.1 before 8.1.11, 8.0 before 8.0.15, 7.4 before 7.4.19, and 7.3 before 7.3.21 uses superuser privileges instead of table owner privileges for (1) VAC…CVE-2007-6600Postgresql · 3.1% likely

    CWE-264

14. PostgreSQL 8.1.0 through 8.1.2 allows authenticated database users to gain additional privileges via "knowledge of the backend protocol" using a crafted SET ROLE to other database…CVE-2006-0553Postgresql · 3.0% likely

    CWE-264

15. The PL/Tcl implementation in PostgreSQL 7.4 before 7.4.29, 8.0 before 8.0.25, 8.1 before 8.1.21, 8.2 before 8.2.17, 8.3 before 8.3.11, 8.4 before 8.4.4, and 9.0 Beta before 9.0 Be…CVE-2010-1170Postgresql · 2.9% likely

    CWE-264

16. The core server component in PostgreSQL 8.4 before 8.4.1, 8.3 before 8.3.8, 8.2 before 8.2.14, 8.1 before 8.1.18, 8.0 before 8.0.22, and 7.4 before 7.4.26 does not use the appropr…CVE-2009-3230Postgresql · 2.8% likely

    CWE-264

17. The Safe (aka Safe.pm) module 2.26, and certain earlier versions, for Perl, as used in PostgreSQL 7.4 before 7.4.29, 8.0 before 8.0.25, 8.1 before 8.1.21, 8.2 before 8.2.17, 8.3 b…CVE-2010-1447Postgresql · 2.8% likely

    CWE-264

18. PostgreSQL 7.4 before 7.4.29, 8.0 before 8.0.25, 8.1 before 8.1.21, 8.2 before 8.2.17, 8.3 before 8.3.11, and 8.4 before 8.4.4 does not properly check privileges during certain RE…CVE-2010-1975Postgresql · 2.7% likely

    CWE-264

19. PostgreSQL, possibly 9.2.x before 9.2.4, 9.1.x before 9.1.9, 9.0.x before 9.0.13, 8.4.x before 8.4.17, and 8.3.x before 8.3.23 incorrectly provides the superuser password to scrip…CVE-2013-1903Postgresql · 2.2% likely

    CWE-264

20. PostgreSQL 8.0.0 and earlier allows local users to bypass the EXECUTE permission check for functions by using the CREATE AGGREGATE command.CVE-2005-0244Postgresql · 2.0% likely

    CWE-264

21. PostgreSQL non-owner REFRESH MATERIALIZED VIEW CONCURRENTLY executes arbitrary SQLCVE-2024-0985Postgresql · CVSS 8 · 1.8% likelycovered by CyberSIXT

    CWE-271

22. A flaw was found in PostgreSQL in versions before 13.2. This flaw allows a user with SELECT privilege on one column to craft a special query that returns all columns of the table.…CVE-2021-20229Postgresql · 1.5% likely

    CWE-863

23. PostgreSQL PL/Java after 9.0 does not honor access controls on large objects.CVE-2016-0768Postgresql · 1.4% likely

    CWE-284

24. PostgreSQL 8.1 and probably later versions, when local trust authentication is enabled and the Database Link library (dblink) is installed, allows remote attackers to access arbit…CVE-2007-3278Postgresql · 1.3% likely

    CWE-264

25. A vulnerability was found in PostgreSQL versions 11.x up to excluding 11.3, 10.x up to excluding 10.8, 9.6.x up to, excluding 9.6.13, 9.5.x up to, excluding 9.5.17. PostgreSQL mai…CVE-2019-10130PostgreSQL Project · CVSS 3.1 · 1.1% likely

    CWE-284

26. PostgreSQL pg_stats_ext and pg_stats_ext_exprs lack authorization checksCVE-2024-4317Postgresql · CVSS 3.1 · 0.7% likely

    CWE-862

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.