https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 20:47:08 +0000 https://vulnerability.circl.lu/vuln/cve-2019-9193 <p>In PostgreSQL 9.3 through 11.2, the &#34;COPY TO/FROM PROGRAM&#34; function allows superusers and users in the &#39;pg_execute_server_program&#39; group to execute arbitrary code in the context of the database&#39;s operating system user. This functionality is enabled by default and can be abused to run arbitrary operating system commands on Windows, Linux, and macOS. NOTE: Third parties claim/state this is not an issue because PostgreSQL functionality for ‘COPY TO/FROM PROGRAM’ is acting as intended. References state that in PostgreSQL, a superuser can execute commands as the server user without using the ‘COPY FROM PROGRAM’.</p> <p>In PostgreSQL 9.3 through 11.2, the &#34;COPY TO/FROM PROGRAM&#34; function allows superusers and users in the &#39;pg_execute_server_program&#39; group to execute arbitrary code in the context of the database&#39;s operating system user. This functionality is enabled by default and can be abused to run arbitrary operating system commands on Windows, Linux, and macOS. NOTE: Third parties claim/state this is not an issue because PostgreSQL functionality for ‘COPY TO/FROM PROGRAM’ is acting as intended. References state that in PostgreSQL, a superuser can execute commands as the server user without using the ‘COPY FROM PROGRAM’.</p> https://vulnerability.circl.lu/vuln/cve-2019-9193