Mehmet Ince

A type confusion issue allows low-privileged database users to corrupt memory by shadowing pgvector's vector type or operators. Users with CREATE privilege on the vectorscale schema can pre-create shadow objects and then build and query DiskANN indexes over crafted values. This process can lead to out-of-bounds reads and writes, resulting in memory disclosure, server crashes, or privilege escalation.

The address standardizer extension contains an out-of-bounds write issue. A database user capable of providing caller-controlled relation names to the `standardize address()` function can trigger memory corruption. This occurs when a rules table is provided with a classification `Type` value that exceeds the fixed class range. The oversized rule type value is used as an index into an internal output-link table without proper bounds checking, leading to an out-of-bounds write.

An out-of-bounds read occurs when the FlatGeobuf property metadata decoder verifies the presence of a string length field but fails to ensure the subsequent string body is within the supplied buffer before converting it into a SQL-visible value. This flaw allows an attacker to provide a malformed FlatGeobuf buffer to cause memory disclosure or a server crash, leading to a denial of service.

An out-of-bounds read occurs when authenticated attackers provide a crafted Simple8b selector-11 value. This value is stored in the signed `int16` Arrow dictionary-index type and bypasses index validation checks during bulk text dictionary decompression. Attackers with direct DML (Data Manipulation Language) access to a non-frozen physical compressed hypertable relation can trigger this read before the base of the live offsets array using the VectorAgg single-text hashing strategy. This can lead to query-result integrity failures, incorrect aggregation output, backend SIGSEGV (a segmentation fault), or PostgreSQL crash recovery.

An out-of-bounds read exists in the Gorilla compression reverse row iterator. Authenticated attackers with DML (Data Manipulation Language) access to a compressed hypertable can cause a denial of service by storing a crafted compressed datum with an internally inconsistent BitArray. This triggers an unsigned integer wraparound during the reverse iterator bucket index computation, leading to a read beyond the bucket array end and a SIGSEGV crash. This crash can be repeatedly triggered during subsequent reverse-order scans.

An out-of-bounds read exists in the Dictionary compression reverse row iterator within the `tsl/src/compression/algorithms/dictionary.c` file. While the forward path validates the decoded index, the reverse path relies on an assertion that is removed from release builds, leaving the 64-bit Simple8b index unvalidated. This allows an attacker with DML (Data Manipulation Language) access to a physical compressed relation to store a crafted datum and execute a reverse-order scan. When using a pass-by-value column type, the out-of-bounds Datum is returned to the client as a standard column value, potentially disclosing backend memory, including the shared buffer pool, bypassing SQL access controls.

A security policy bypass exists that allows any database user with SQL execution permissions to extract plaintext AWS credentials. By calling the `load aws credentials()` function and setting the `redact secret` parameter to false, a user can circumvent the database-wide `allow unredacted secrets=false` policy. This allows the retrieval of the AWS credential chain, including `access key id`, `secret access key`, `session token`, and `region`. This is especially critical in managed environments where `pg duckdb` is preloaded and credential chains like IMDSv2, IRSA, ECS task role, or EC2 instance role are accessible.

The pglogical queue mechanism, which transmits out-of-band commands like replicated DDL (Data Definition Language) from a publisher to a subscriber, executes message payloads on the subscriber using the privilege level of the apply worker. In default installations, this level is equivalent to a PostgreSQL superuser. An attacker acting as the publisher can send crafted queue messages to execute arbitrary SQL on the subscriber as a superuser. This allows for privilege escalation from a role permitted to use pglogical to full superuser status, potentially breaking tenant isolation in shared deployments. Exploitation requires the attacker to direct a subscription to an endpoint they control, a capability typically reserved for superusers but often delegated to non-superuser roles in managed deployments.

When applying replicated changes for a row missing one or more columns, pglogical evaluates the affected table's default expressions on the subscriber. Since the apply worker operates with privileges equivalent to a PostgreSQL superuser in default installations, any function triggered by a default expression also executes with those privileges. A malicious publisher can exploit this to execute functions on the subscriber as a superuser, escalating privileges from a role permitted to use pglogical to full superuser. This issue is particularly relevant in managed deployments where the ability to create subscriptions has been delegated to non-superuser roles, as exploitation requires directing a subscription to an endpoint controlled by the attacker.

A use-after-free condition exists in the worker signaling code. This occurs when a worker structure is dereferenced after the underlying slot has been freed or recycled during normal worker lifecycle events. A low-privileged user can trigger this condition by influencing the timing of worker start, stop, and restart operations. This typically results in the crashing of replication workers, affecting availability, but could potentially be used to achieve remote code execution with the privileges of the PostgreSQL backend.

The apply worker fails to sufficiently validate the length of certain fields in incoming replication protocol messages before copying them, leading to an out-of-bounds read. An attacker acting as a publisher can send crafted messages that cause the subscriber's apply worker to read beyond the bounds of an allocated buffer, which may result in the disclosure of adjacent process memory or a worker crash. Exploitation requires the ability to direct a subscription to an endpoint controlled by the attacker. While this typically requires superuser privileges, it is particularly critical in managed deployments where subscription creation is delegated to non-superuser roles.

An unauthenticated arbitrary file upload issue exists in the Tiki Wiki CMS Groupware software. The vulnerability is located within the ELFinder component’s default connector (`connector.minimal.php`). It allows remote attackers to upload and execute malicious PHP scripts in the context of the web server due to a lack of file type validation. Attackers can craft a POST request to upload executable PHP payloads through the ELFinder interface exposed at `/vendor extra/elfinder/`.

A remote code execution issue exists in CryptoLog (PHP version) due to a combination of SQL injection and command injection vulnerabilities. An unauthenticated attacker can achieve shell access as the web server user. The attack sequence involves exploiting a SQL injection flaw in `login.php` to bypass authentication, followed by command injection in the `/logshares ajax.php` API endpoint. The login bypass is achieved by submitting crafted SQL via the `user` POST parameter. After authentication, the attacker can leverage the `lsid` POST parameter in the `/logshares ajax.php` endpoint to inject and execute a command using $(...) syntax. This exploitation path is not present in the ASP.NET version of CryptoLog released since 2009.

The issue concerns a Server-Side Request Forgery (SSRF) and Information Disclosure vulnerability.

The issue is related to a Server-Side Request Forgery (SSRF) and Information Disclosure vulnerability in the database schema of PostHog.

The issue concerns a SQL injection vulnerability in PostHog's ClickHouse table functions, potentially leading to remote code execution.

The issue is related to the improper neutralization of POST requests sent to a specific port with version information. This could be exploited by an attacker to execute arbitrary commands on the affected system. The vulnerability is associated with the failure to neutralize special elements used in the operating system command. Exploitation of the vulnerability may allow a remote attacker to execute arbitrary code by sending specially crafted POST requests.

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: Expired and unusable administrator authentication tokens can be revealed by units that have timed out from ETM access. This issue concerns the potential disclosure of authentication tokens for administrators that are expired and unusable, which might be exposed by units that have lost ETM access due to a timeout. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

A user with administrator privileges is able to retrieve authentication tokens.

Multiple SQL Injection vulnerabilities exist in the reporting application, allowing a user with advanced report application access rights to exploit the SQL injection. This enables them to execute commands on the underlying operating system with elevated privileges.