Mehmet Ince

**Name of the Vulnerable Software and Affected Versions** PostGIS address standardizer versions prior to 3.7.0 **Description** The address standardizer extension contains an out-of-bounds write issue. A database user capable of providing caller-controlled relation names to the `standardize address()` function can trigger memory corruption. This occurs when a rules table is provided with a classification `Type` value that exceeds the fixed class range. The oversized rule type value is used as an index into an internal output-link table without proper bounds checking, leading to an out-of-bounds write. **Recommendations** Update to the version containing commit 423570b. Restrict the ability of users to supply caller-controlled relation names to the `standardize address()` function.

**Name of the Vulnerable Software and Affected Versions** PostGIS versions prior to 3.7.0beta2 **Description** An out-of-bounds read occurs when the FlatGeobuf property metadata decoder verifies the presence of a string length field but fails to ensure the subsequent string body is within the supplied buffer before converting it into a SQL-visible value. This flaw allows an attacker to provide a malformed FlatGeobuf buffer to cause memory disclosure or a server crash, leading to a denial of service. **Recommendations** Update PostGIS to version 3.7.0beta2 or later.

**Name of the Vulnerable Software and Affected Versions** TimescaleDB versions prior to 2.29.1 **Description** An out-of-bounds read exists in the Dictionary compression reverse row iterator within the `tsl/src/compression/algorithms/dictionary.c` file. While the forward path validates the decoded index, the reverse path relies on an assertion that is removed from release builds, leaving the 64-bit Simple8b index unvalidated. This allows an attacker with DML (Data Manipulation Language) access to a physical compressed relation to store a crafted datum and execute a reverse-order scan. When using a pass-by-value column type, the out-of-bounds Datum is returned to the client as a standard column value, potentially disclosing backend memory, including the shared buffer pool, bypassing SQL access controls. **Recommendations** Update TimescaleDB to a version that includes the fix implemented in commit 517c13e.

**Name of the Vulnerable Software and Affected Versions** TimescaleDB versions prior to 2.29.1 **Description** An out-of-bounds read occurs when authenticated attackers provide a crafted Simple8b selector-11 value. This value is stored in the signed `int16` Arrow dictionary-index type and bypasses index validation checks during bulk text dictionary decompression. Attackers with direct DML (Data Manipulation Language) access to a non-frozen physical compressed hypertable relation can trigger this read before the base of the live offsets array using the VectorAgg single-text hashing strategy. This can lead to query-result integrity failures, incorrect aggregation output, backend SIGSEGV (a segmentation fault), or PostgreSQL crash recovery. **Recommendations** Update TimescaleDB to version 2.29.1 or later to apply the fix implemented in commit 517c13e.

**Name of the Vulnerable Software and Affected Versions** TimescaleDB versions prior to 2.29.2 **Description** An out-of-bounds read exists in the Gorilla compression reverse row iterator. Authenticated attackers with DML (Data Manipulation Language) access to a compressed hypertable can cause a denial of service by storing a crafted compressed datum with an internally inconsistent BitArray. This triggers an unsigned integer wraparound during the reverse iterator bucket index computation, leading to a read beyond the bucket array end and a SIGSEGV crash. This crash can be repeatedly triggered during subsequent reverse-order scans. **Recommendations** Update to version 2.29.2 or later to apply the fix implemented in commit 517c13e.

**Name of the Vulnerable Software and Affected Versions** DuckDB AWS extension (affected versions not specified) **Description** A security policy bypass exists that allows any database user with SQL execution permissions to extract plaintext AWS credentials. By calling the `load aws credentials()` function and setting the `redact secret` parameter to false, a user can circumvent the database-wide `allow unredacted secrets=false` policy. This allows the retrieval of the AWS credential chain, including `access key id`, `secret access key`, `session token`, and `region`. This is especially critical in managed environments where `pg duckdb` is preloaded and credential chains like IMDSv2, IRSA, ECS task role, or EC2 instance role are accessible. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary mitigation, restrict the use of the `load aws credentials()` function or limit SQL execution permissions for untrusted users.

**Name of the Vulnerable Software and Affected Versions** pglogical (affected versions not specified) **Description** When applying replicated changes for a row missing one or more columns, pglogical evaluates the affected table's default expressions on the subscriber. Since the apply worker operates with privileges equivalent to a PostgreSQL superuser in default installations, any function triggered by a default expression also executes with those privileges. A malicious publisher can exploit this to execute functions on the subscriber as a superuser, escalating privileges from a role permitted to use pglogical to full superuser. This issue is particularly relevant in managed deployments where the ability to create subscriptions has been delegated to non-superuser roles, as exploitation requires directing a subscription to an endpoint controlled by the attacker. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** pglogical (affected versions not specified) **Description** The apply worker fails to sufficiently validate the length of certain fields in incoming replication protocol messages before copying them, leading to an out-of-bounds read. An attacker acting as a publisher can send crafted messages that cause the subscriber's apply worker to read beyond the bounds of an allocated buffer, which may result in the disclosure of adjacent process memory or a worker crash. Exploitation requires the ability to direct a subscription to an endpoint controlled by the attacker. While this typically requires superuser privileges, it is particularly critical in managed deployments where subscription creation is delegated to non-superuser roles. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** pglogical (affected versions not specified) **Description** A use-after-free condition exists in the worker signaling code. This occurs when a worker structure is dereferenced after the underlying slot has been freed or recycled during normal worker lifecycle events. A low-privileged user can trigger this condition by influencing the timing of worker start, stop, and restart operations. This typically results in the crashing of replication workers, affecting availability, but could potentially be used to achieve remote code execution with the privileges of the PostgreSQL backend. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** pglogical (affected versions not specified) **Description** The pglogical queue mechanism, which transmits out-of-band commands like replicated DDL (Data Definition Language) from a publisher to a subscriber, executes message payloads on the subscriber using the privilege level of the apply worker. In default installations, this level is equivalent to a PostgreSQL superuser. An attacker acting as the publisher can send crafted queue messages to execute arbitrary SQL on the subscriber as a superuser. This allows for privilege escalation from a role permitted to use pglogical to full superuser status, potentially breaking tenant isolation in shared deployments. Exploitation requires the attacker to direct a subscription to an endpoint they control, a capability typically reserved for superusers but often delegated to non-superuser roles in managed deployments. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Tiki Wiki CMS Groupware versions 15.1 and earlier **Description** An unauthenticated arbitrary file upload issue exists in the Tiki Wiki CMS Groupware software. The vulnerability is located within the ELFinder component’s default connector (`connector.minimal.php`). It allows remote attackers to upload and execute malicious PHP scripts in the context of the web server due to a lack of file type validation. Attackers can craft a POST request to upload executable PHP payloads through the ELFinder interface exposed at `/vendor extra/elfinder/`. **Recommendations** Versions prior to 15.1 are affected. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions:** CryptoLog (PHP version, affected versions not specified) **Description:** A remote code execution issue exists in CryptoLog (PHP version) due to a combination of SQL injection and command injection vulnerabilities. An unauthenticated attacker can achieve shell access as the web server user. The attack sequence involves exploiting a SQL injection flaw in `login.php` to bypass authentication, followed by command injection in the `/logshares ajax.php` API endpoint. The login bypass is achieved by submitting crafted SQL via the `user` POST parameter. After authentication, the attacker can leverage the `lsid` POST parameter in the `/logshares ajax.php` endpoint to inject and execute a command using $(...) syntax. This exploitation path is not present in the ASP.NET version of CryptoLog released since 2009. **Recommendations:** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** PostHog versions (affected versions not specified) **Description** The issue concerns a Server-Side Request Forgery (SSRF) and Information Disclosure vulnerability. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** PostHog (affected versions not specified) **Description** The issue is related to a Server-Side Request Forgery (SSRF) and Information Disclosure vulnerability in the database schema of PostHog. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** PostHog (affected versions not specified) **Description** The issue concerns a SQL injection vulnerability in PostHog's ClickHouse table functions, potentially leading to remote code execution. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** mySCADA myPRO (affected versions not specified) **Description** The issue is related to the improper neutralization of POST requests sent to a specific port with version information. This could be exploited by an attacker to execute arbitrary commands on the affected system. The vulnerability is associated with the failure to neutralize special elements used in the operating system command. Exploitation of the vulnerability may allow a remote attacker to execute arbitrary code by sending specially crafted POST requests. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: Expired and unusable administrator authentication tokens can be revealed by units that have timed out from ETM access. This issue concerns the potential disclosure of authentication tokens for administrators that are expired and unusable, which might be exposed by units that have lost ETM access due to a timeout. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** No specific software or versions are mentioned in the provided descriptions. **Description** A user with administrator privileges is able to retrieve authentication tokens. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Arista Edge Threat Management versions up to 17.1.1 **Description** Multiple SQL Injection vulnerabilities exist in the reporting application, allowing a user with advanced report application access rights to exploit the SQL injection. This enables them to execute commands on the underlying operating system with elevated privileges. **Recommendations** For Arista Edge Threat Management versions up to 17.1.1, consider restricting access to the reporting application to minimize the risk of exploitation until a security fix is applied. As a temporary workaround, limit the privileges of users with advanced report application access rights to prevent elevated command execution on the underlying operating system. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** No specific software or versions are mentioned in the provided descriptions. **Description** The issue concerns the ability of administrators to configure an insecure captive portal script. This allows for potential security risks, as an insecure script could be exploited. No information is provided about the estimated number of potentially affected devices or real-world incidents where this issue was exploited. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.