CVE-2023-23554

Uncontrolled search path element vulnerability exists in pg_ivm versions prior to 1.5.1. When refreshing an IMMV, pg_ivm executes functions without specifying schema names. Under certain conditions, pg_ivm may be tricked to execute unexpected functions from other schemas with the IMMV owner's privilege. If this vulnerability is exploited, an unexpected function provided by an attacker may be executed with the privilege of the materialized view owner.

• CWE-427
• CWE-427

• https://github.com/sraoss/pg_ivmProduct
• https://github.com/sraoss/pg_ivm/releases/tag/v1.5.1Release Notes
• https://jvn.jp/en/jp/JVN19872280/Third Party Advisory
• https://github.com/sraoss/pg_ivmProduct
• https://github.com/sraoss/pg_ivm/releases/tag/v1.5.1Release Notes
• https://jvn.jp/en/jp/JVN19872280/Third Party Advisory

Published

Mar 7, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-23549Improper Input Validation in Checkmk <2.2.0p15, <2.1.0p37, <…2.7
• CVE-2023-2355Local privilege escalation due to a DLL hijacking vulnerabil…7.8
• CVE-2023-23550An OS command injection vulnerability exists in the ys_third…7.2
• CVE-2023-23551 Control By Web X-600M devices run Lua scripts and are vul…9.8
• CVE-2023-23552On versions 17.0.x before 17.0.0.2, 16.1.x before 16.1.3.3, …7.5
• CVE-2023-23553 Control By Web X-400 devices are vulnerable to a cross-site…6.1
• CVE-2023-23555On BIG-IP Virtual Edition versions 15.1x beginning in 15.1.4…7.5
• CVE-2023-23556An error in BigInt conversion to Number in Hermes prior to c…9.8
• CVE-2023-23557An error in Hermes' algorithm for copying objects properties…9.8
• CVE-2023-23558In Eternal Terminal 6.2.1, TelemetryService uses fixed paths…6.3
• CVE-2023-23559In rndis_query_oid in drivers/net/wireless/rndis_wlan.c in t…7.8
• CVE-2023-2356Relative Path Traversal in GitHub repository mlflow/mlflow p…7.5