CVE-2019-10127

A vulnerability was found in postgresql versions 11.x prior to 11.3. The Windows installer for BigSQL-supplied PostgreSQL does not lock down the ACL of the binary installation directory or the ACL of the data directory; it keeps the inherited ACL. In the default configuration, an attacker having both an unprivileged Windows account and an unprivileged PostgreSQL account can cause the PostgreSQL service account to execute arbitrary code. An attacker having only the unprivileged Windows account can read arbitrary data directory files, essentially bypassing database-imposed read access limitations. An attacker having only the unprivileged Windows account can also delete certain data directory files.

• CWE-284

• https://bugzilla.redhat.com/show_bug.cgi?id=1707098Issue Tracking, Third Party Advisory
• https://security.netapp.com/advisory/ntap-20210430-0004/Third Party Advisory
• https://www.postgresql.org/about/news/1939/Patch, Release Notes, Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=1707098Issue Tracking, Third Party Advisory
• https://security.netapp.com/advisory/ntap-20210430-0004/Third Party Advisory
• https://www.postgresql.org/about/news/1939/Patch, Release Notes, Vendor Advisory

Published

Mar 19, 2021

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-10121eQ-3 HomeMatic CCU2 devices before 2.41.8 and CCU3 devices b…
• CVE-2019-10122eQ-3 HomeMatic CCU2 devices before 2.41.9 and CCU3 devices b…
• CVE-2019-10123SQL Injection in Advanced InfoData Systems (AIS) ESEL-Server…
• CVE-2019-10124Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2019-10125An issue was discovered in aio_poll() in fs/aio.c in the Lin…9.8
• CVE-2019-10126A flaw was found in the Linux kernel. A heap based buffer ov…9.8
• CVE-2019-10128A vulnerability was found in postgresql versions 11.x prior …7.8
• CVE-2019-10129A vulnerability was found in postgresql versions 11.x prior …6.5
• CVE-2019-1013An information disclosure vulnerability exists when the Wind…4.7
• CVE-2019-10130A vulnerability was found in PostgreSQL versions 11.x up to …4.3
• CVE-2019-10131An off-by-one read vulnerability was discovered in ImageMagi…7.1
• CVE-2019-10132A vulnerability was found in libvirt >= 4.1.0 in the virtloc…8.8