CVE-2023-5868

MediumCVSS 4.3/10Last modified Jun 23, 2026

Description

A memory disclosure vulnerability was found in PostgreSQL that allows remote users to access sensitive information by exploiting certain aggregate function calls with 'unknown'-type arguments. Handling 'unknown'-type values from string literals without type designation can disclose bytes, potentially revealing notable and confidential information. This issue exists due to excessive data output in aggregate function calls, enabling remote users to read some portion of system memory.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-686

Affected software

No affected versions have been published.

Timeline

Published: Dec 10, 2023
Last modified: Jun 23, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-58698.8A flaw was found in PostgreSQL that allows authenticated database users to execute arbitrary code through missing overflow checks during SQL CVE-2023-58704.4A flaw was found in PostgreSQL involving the pg_cancel_backend role that signals background workers, including the logical replication launc CVE-2023-58715.3A flaw was found in libnbd, due to a malicious Network Block Device (NBD), a protocol for accessing Block Devices such as hard disks over a CVE-2023-58724.3In Wago Smart Designer in versions up to 2.33.1 a low privileged remote attacker may enumerate projects and usernames through iterative requ CVE-2023-58735.4Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 11.1.0.CVE-2023-58744.8The Popup box WordPress plugin before 3.8.6 does not sanitise and escape some of its settings, which could allow high privilege users such a CVE-2023-58755.3Mattermost Desktop fails to correctly handle permissions or prompt the user for consent on certain sensitive ones allowing media exploitatio CVE-2023-58765.3Mattermost fails to properly validate a RegExp built off the server URL path, allowing an attacker in control of an enrolled server to mount CVE-2023-58779.8The affiliate-toolkit WordPress plugin before 3.4.3 lacks authorization and authentication for requests to it's affiliate-toolkit-starter/to CVE-2023-58789.4Honeywell OneWireless Wireless Device Manager (WDM) for the following versions R310.x, R320.x, R321.x, R322.1, R322.2, R323.x, R330.1 cont CVE-2023-58796.8Users’ product account authentication data was stored in clear text in The Genie Company Aladdin Connect Mobile Application Version 5.65 Bui CVE-2023-58808.8When the Genie Company Aladdin Connect garage door opener (Retrofit-Kit Model ALDCM) is placed into configuration mode the web servers “Gara