OAuth2 client ID and secret exposed through the web browser

概要

参考情報

• nvd.nist.gov/vuln/detail/CVE-2024-9014 · ADVISORY
• pgadmin-org/pgadmin4 · WEB
• pgadmin-org/pgadmin4 · PACKAGE
• pgadmin.org/docs/pgadmin4/8.12/release_notes_8_12.html · WEB
• pypi.org/project/pgadmin4 · PACKAGE
• GitHub Advisory GHSA-jm9x-rx9x-wpqj · ADVISORY

pgadmin4 のその他の脆弱性

• CVE-2026-7820中 6.5Improper restriction of excessive authentication attempts (CWE-307) in pgAdmin 4. pgAdmin enforces MAX_LOGIN_ATTEMPTS only inside its custo…
• CVE-2026-7819高 8.1Symbolic-link path traversal (CWE-61, CWE-22) in pgAdmin 4 File Manager. check_access_permission used os.path.abspath, which resolves '..' …
• CVE-2026-7818高 7.8Deserialization of untrusted data (CWE-502) in pgAdmin 4 FileBackedSessionManager. The session manager performed unsafe deserialization of …
• CVE-2026-7817中 6.5Local file inclusion (LFI) and server-side request forgery (SSRF) vulnerabilities in pgAdmin 4 LLM API configuration endpoints. User-suppli…
• CVE-2026-7816高 8.8OS command injection (CWE-78) vulnerability in pgAdmin 4 Import/Export query export. User-supplied input was interpolated directly into a p…