deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-52553
Published: 2024-11-13
Description: Jenkins OpenId Connect Authentication Plugin 4.418.vccc7061f5b_6d and earlier does not invalidate the previous session on login.
CVSS Score: 8.8 (HIGH)
CWE: CWE-613
References: https://www.jenkins.io/security/advisory/2024-11-13/#SECURITY-3473
CVE: CVE-2024-52554
Published: 2024-11-13
Description: Jenkins Shared Library Version Override Plugin 17.v786074c9fce7 and earlier declares folder-scoped library overrides as trusted, so that they're not executed in the Script Security sandbox, allowing attackers with Item/Configure permission on a folder to configure a folder-scoped library override that runs without sandbox protection.
CVSS Score: 8.8 (HIGH)
CWE: CWE-862
References: https://www.jenkins.io/security/advisory/2024-11-13/#SECURITY-3466
CVE: CVE-2024-50955
Published: 2024-11-13
Description: An issue in how XINJE XD5E-24R and XL5E-16T v3.5.3b handles TCP protocol messages allows attackers to cause a Denial of Service (DoS) via a crafted TCP message.
CVSS Score: 7.5 (HIGH)
CWE: CWE-770
References: https://github.com/Curator-Kim/Vulnerability-mining/blob/master/XINJE%20XD5E-24R%20XL5E-16T%20TCP%20DoS/XINJE%20XD5E-24R%20XL5E-16T%20TCP%20DoS.md
CVE: CVE-2024-50956
Published: 2024-11-13
Description: A buffer overflow in the RecvSocketData function of Inovance HCPLC_AM401-CPU1608TPTN 21.38.0.0, HCPLC_AM402-CPU1608TPTN 41.38.0.0, and HCPLC_AM403-CPU1608TN 81.38.0.0 allows attackers to cause a Denial of Service (DoS) or execute arbitrary code via a crafted Modbus message.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-120
References: https://github.com/Curator-Kim/Vulnerability-mining/blob/master/INOVANCE%20AM400%20Series%20Modbus%20buffer%20overflow/INOVANCE%20AM400%20Series%20Modbus%20buffer%20overflow.md
CVE: CVE-2024-51027
Published: 2024-11-13
Description: Ruijie NBR800G gateway NBR_RGOS_11.1(6)B4P9 is vulnerable to command execution in /itbox_pi/networksafe.php via the province parameter.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-77
References: https://gist.github.com/zty-1995/29464500cd474f70a78e23ca68791cdd; https://github.com/zty-1995/SmartGateway/blob/cd56e1d00c56589accddb63b465b31f6387b51c2/NBR800G_networksafe/README.md
CVE: CVE-2024-40404
Published: 2024-11-13
Description: Cybele Software Thinfinity Workspace before v7.0.2.113 was discovered to contain an access control issue in the API endpoint where Web Sockets connections are established.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-306
References: https://blog.cybelesoft.com/thinfinity-workspace-security-bulletin-nov-2024/
CVE: CVE-2024-40405
Published: 2024-11-13
Description: Incorrect access control in Cybele Software Thinfinity Workspace before v7.0.3.109 allows attackers to gain access to a secondary broker via a crafted request.
CVSS Score: 8.1 (HIGH)
CWE: CWE-306
References: https://blog.cybelesoft.com/thinfinity-workspace-security-bulletin-nov-2024/
CVE: CVE-2024-40407
Published: 2024-11-13
Description: A full path disclosure in Cybele Software Thinfinity Workspace before v7.0.2.113 allows attackers to obtain the root path of the application via unspecified vectors.
CVSS Score: 7.5 (HIGH)
References: https://blog.cybelesoft.com/thinfinity-workspace-security-bulletin-nov-2024/
CVE: CVE-2024-40408
Published: 2024-11-13
Description: Cybele Software Thinfinity Workspace before v7.0.2.113 was discovered to contain an access control issue in the Create Profile section. This vulnerability allows attackers to create arbitrary user profiles with elevated privileges.
CVSS Score: 7.3 (HIGH)
CWE: CWE-306
References: https://blog.cybelesoft.com/thinfinity-workspace-security-bulletin-nov-2024/
CVE: CVE-2024-40410
Published: 2024-11-13
Description: Cybele Software Thinfinity Workspace before v7.0.2.113 was discovered to contain a hardcoded cryptographic key used for encryption.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-798
References: https://blog.cybelesoft.com/thinfinity-workspace-security-bulletin-nov-2024/
CVE: CVE-2024-5083
Published: 2024-11-14
Description: A stored Cross-site Scripting vulnerability has been discovered in Sonatype Nexus Repository 2

This issue affects Nexus Repository 2 OSS/Pro versions up to and including 2.15.1.
CWE: CWE-79
References: https://support.sonatype.com/hc/en-us/articles/[PII_REDACTED]1987
CVE: CVE-2024-5082
Published: 2024-11-14
Description: A Remote Code Execution vulnerability has been discovered in Sonatype Nexus Repository 2. 

This issue affects Nexus Repository 2 OSS/Pro versions up to and including 2.15.1.
CWE: CWE-94
References: https://support.sonatype.com/hc/en-us/articles/[PII_REDACTED]0755
CVE: CVE-2023-34049
Published: 2024-11-14
Description: The Salt-SSH pre-flight option copies the script to the target at a predictable path, which allows an attacker to force Salt-SSH to run their script. If an attacker has access to the target VM and knows the path to the pre-flight script before it runs they can ensure Salt-SSH runs their script with the privileges of the user running Salt-SSH. Do not make the copy path on the target predictable and ensure we check return codes of the scp command if the copy fails.
CVSS Score: 6.7 (MEDIUM)
References: https://saltproject.io/security-announcements/2023-10-27-advisory/
CVE: CVE-2024-10146
Published: 2024-11-14
Description: The Simple File List WordPress plugin before 6.1.13 does not sanitise and escape a generated URL before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting which could be used against admins.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/9ee74a0f-83ff-4c15-a114-f8f6baab8bf5/
CVE: CVE-2024-9186
Published: 2024-11-14
Description: The Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit WordPress plugin before 3.3.0 does not sanitize and escape the bwfan-track-id  parameter before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks
CVSS Score: 8.6 (HIGH)
CWE: CWE-89
References: https://wpscan.com/vulnerability/fab29b59-7e87-4289-88dd-ed5520260c26/
CVE: CVE-2024-11206
Published: 2024-11-14
Description: Unauthorized access vulnerability in the mobile application (com.transsion.phoenix) can lead to the leakage of user information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-359
References: https://security.tecno.com/SRC/blogdetail/340?lang=en_US; https://security.tecno.com/SRC/securityUpdates
CVE: CVE-2024-7787
Published: 2024-11-14
Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in ITG Computer Technology vSRM Supplier Relationship Management System allows Reflected XSS, Cross-Site Scripting (XSS).This issue affects vSRM Supplier Relationship Management System: before 28.08.2024.
CWE: CWE-79
References: https://www.usom.gov.tr/bildirim/tr-24-1853
CVE: CVE-2024-2550
Published: 2024-11-14
Description: A null pointer dereference vulnerability in the GlobalProtect gateway in Palo Alto Networks PAN-OS software enables an unauthenticated attacker to stop the GlobalProtect service on the firewall by sending a specially crafted packet that causes a denial of service (DoS) condition. Repeated attempts to trigger this condition result in the firewall entering maintenance mode.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476, CWE-476
References: https://security.paloaltonetworks.com/CVE-2024-2550
CVE: CVE-2024-2551
Published: 2024-11-14
Description: A null pointer dereference vulnerability in Palo Alto Networks PAN-OS software enables an unauthenticated attacker to stop a core system service on the firewall by sending a crafted packet through the data plane that causes a denial of service (DoS) condition. Repeated attempts to trigger this condition result in the firewall entering maintenance mode.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476, CWE-476
References: https://security.paloaltonetworks.com/CVE-2024-2551
CVE: CVE-2024-2552
Published: 2024-11-14
Description: A command injection vulnerability in Palo Alto Networks PAN-OS software enables an authenticated administrator to bypass system restrictions in the management plane and delete files on the firewall.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-22, CWE-22
References: https://security.paloaltonetworks.com/CVE-2024-2552
CVE: CVE-2024-38479
Published: 2024-11-14
Description: Improper Input Validation vulnerability in Apache Traffic Server.

This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.5.

Users are recommended to upgrade to version 9.2.6, which fixes the issue, or 10.0.2, which does not have the issue.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://lists.apache.org/thread/y15fh6c7kyqvzm0f9odw7c5jh4r4np0y; https://lists.debian.org/debian-lts-announce/2025/02/msg00018.html
CVE: CVE-2024-45253
Published: 2024-11-14
Description: Avigilon – CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://www.gov.il/en/Departments/faq/cve_advisories
CVE: CVE-2024-45254
Published: 2024-11-14
Description: VaeMendis - CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSS Score: 7.5 (HIGH)
CWE: CWE-79
References: https://www.gov.il/en/Departments/faq/cve_advisories
CVE: CVE-2024-47914
Published: 2024-11-14
Description: VaeMendis - CWE-352: Cross-Site Request Forgery (CSRF)
CVSS Score: 4.5 (MEDIUM)
CWE: CWE-352
References: https://www.gov.il/en/Departments/faq/cve_advisories
CVE: CVE-2024-47915
Published: 2024-11-14
Description: VaeMendis -  CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://www.gov.il/en/Departments/faq/cve_advisories
CVE: CVE-2024-47916
Published: 2024-11-14
Description: Boa web server - CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://www.gov.il/en/Departments/faq/cve_advisories
CVE: CVE-2024-50305
Published: 2024-11-14
Description: Valid Host header field can cause Apache Traffic Server to crash on some platforms.

This issue affects Apache Traffic Server: from 9.2.0 through 9.2.5.

Users are recommended to upgrade to version 9.2.6, which fixes the issue, or 10.0.2, which does not have the issue.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20, CWE-120
References: https://lists.apache.org/thread/y15fh6c7kyqvzm0f9odw7c5jh4r4np0y
CVE: CVE-2024-50306
Published: 2024-11-14
Description: Unchecked return value can allow Apache Traffic Server to retain privileges on startup.

This issue affects Apache Traffic Server: from 9.2.0 through 9.2.5, from 10.0.0 through 10.0.1.

Users are recommended to upgrade to version 9.2.6 or 10.0.2, which fixes the issue.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-252
References: https://lists.apache.org/thread/y15fh6c7kyqvzm0f9odw7c5jh4r4np0y; https://lists.debian.org/debian-lts-announce/2025/02/msg00018.html
CVE: CVE-2024-5917
Published: 2024-11-14
Description: A server-side request forgery in PAN-OS software enables an authenticated attacker with administrative privileges to use the administrative web interface as a proxy, which enables the attacker to view internal network resources not otherwise accessible.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-918, CWE-918
References: https://security.paloaltonetworks.com/CVE-2024-5917
CVE: CVE-2024-5918
Published: 2024-11-14
Description: An improper certificate validation vulnerability in Palo Alto Networks PAN-OS software enables an authorized user with a specially crafted client certificate to connect to an impacted GlobalProtect portal or GlobalProtect gateway as a different legitimate user. This attack is possible only if you "Allow Authentication with User Credentials OR Client Certificate."
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-295
References: https://security.paloaltonetworks.com/CVE-2024-5918
CVE: CVE-2024-5919
Published: 2024-11-14
Description: A blind XML External Entities (XXE) injection vulnerability in the Palo Alto Networks PAN-OS software enables an authenticated attacker to exfiltrate arbitrary files from firewalls to an attacker controlled server. This attack requires network access to the firewall management interface.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-611, CWE-611
References: https://security.paloaltonetworks.com/CVE-2024-5919
CVE: CVE-2024-5920
Published: 2024-11-14
Description: A cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS software enables an authenticated read-write Panorama administrator to push a specially crafted configuration to a PAN-OS node. This enables impersonation of a legitimate PAN-OS administrator who can perform restricted actions on the PAN-OS node after the execution of JavaScript in the legitimate PAN-OS administrator's browser.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://security.paloaltonetworks.com/CVE-2024-5920
CVE: CVE-2024-9472
Published: 2024-11-14
Description: A null pointer dereference in Palo Alto Networks PAN-OS software on PA-800 Series, PA-3200 Series, PA-5200 Series, and PA-7000 Series hardware platforms when Decryption policy is enabled allows an unauthenticated attacker to crash PAN-OS by sending specific traffic through the data plane, resulting in a denial of service (DoS) condition. Repeated attempts to trigger this condition will result in PAN-OS entering maintenance mode.


Palo Alto Networks VM-Series, Cloud NGFW, and Prisma Access are not affected.


This issue only affects PA-800 Series, PA-3200 Series, PA-5200 Series, and PA-7000 Series running these specific versions of PAN-OS:

  *  10.2.7-h12
  *  10.2.8-h10
  *  10.2.9-h9
  *  10.2.9-h11
  *  10.2.10-h2
  *  10.2.10-h3
  *  10.2.11
  *  10.2.11-h1
  *  10.2.11-h2
  *  10.2.11-h3
  *  11.1.2-h9
  *  11.1.2-h12
  *  11.1.3-h2
  *  11.1.3-h4
  *  11.1.3-h6
  *  11.2.2
  *  11.2.2-h1
CWE: CWE-476
References: https://security.paloaltonetworks.com/CVE-2024-9472
CVE: CVE-2023-4134
Published: 2024-11-14
Description: A use-after-free vulnerability was found in the cyttsp4_core driver in the Linux kernel. This issue occurs in the device cleanup routine due to a possible rearming of the watchdog_timer from the workqueue. This could allow a local user to crash the system, causing a denial of service.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-416, CWE-416
References: https://access.redhat.com/security/cve/CVE-2023-4134; https://bugzilla.redhat.com/show_bug.cgi?id=2221700
CVE: CVE-2024-10571
Published: 2024-11-14
Description: The Chartify – WordPress Chart Plugin plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.9.5 via the 'source' parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-98
References: https://abrahack.com/posts/chart-builder-lfi/; https://plugins.trac.wordpress.org/browser/chart-builder/tags/2.9.6/admin/partials/charts/actions/chart-builder-charts-actions-options.php?rev=3184238; https://www.wordfence.com/threat-intel/vulnerabilities/id/d4837258-c749-4194-926c-22b67e20c1fc?source=cve
CVE: CVE-2024-8180
Published: 2024-11-14
Description: An issue has been discovered in GitLab CE/EE affecting all versions from 17.3 before 17.3.7, 17.4 before 17.4.4, and 17.5 before 17.5.2. Improper output encoding could lead to XSS if CSP is not enabled.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://about.gitlab.com/releases/2024/11/13/patch-release-gitlab-17-5-2-released/#html-injection-in-vulnerability-code-flow-could-lead-to-xss-on-self-hosted-instances; https://gitlab.com/gitlab-org/gitlab/-/issues/480720; https://hackerone.com/reports/2654010
CVE: CVE-2024-9693
Published: 2024-11-14
Description: An issue was discovered in GitLab CE/EE affecting all versions starting from 16.0 prior to 17.3.7, starting from 17.4 prior to 17.4.4, and starting from 17.5 prior to 17.5.2, which could have allowed unauthorized access to the Kubernetes agent in a cluster under specific configurations.
CVSS Score: 8.5 (HIGH)
CWE: CWE-863
References: https://gitlab.com/gitlab-org/gitlab/-/issues/497449
CVE: CVE-2022-31666
Published: 2024-11-14
Description: Harbor fails to validate user permissions while deleting Webhook policies, allowing malicious users to view, update and delete Webhook policies of other users.  The attacker could modify Webhook policies configured in other projects.
CVSS Score: 7.7 (HIGH)
CWE: CWE-285, CWE-862
References: https://github.com/goharbor/harbor/security/advisories/GHSA-8hwq-5f22-jfr3
CVE: CVE-2022-31667
Published: 2024-11-14
Description: Harbor fails to validate the user permissions when updating a robot account that belongs to a project that the authenticated user doesn’t have access to. 

By sending a request that attempts to update a robot account, and specifying a robot account id and robot account name that belongs to a different project that the user doesn’t have access to, it was possible to revoke the robot account permissions.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-285, CWE-863
References: https://github.com/goharbor/harbor/security/advisories/GHSA-xx9w-464f-7h6f
CVE: CVE-2022-31668
Published: 2024-11-14
Description: Harbor fails to validate the user permissions when updating p2p preheat policies. By sending a request to update a p2p preheat policy with an id that belongs to a project that the currently authenticated user doesn't have access to, the attacker could modify p2p preheat policies configured in other projects.
CVSS Score: 7.4 (HIGH)
CWE: CWE-285, CWE-863
References: https://github.com/goharbor/harbor/security/advisories/GHSA-3wpx-625q-22j7
CVE: CVE-2022-31669
Published: 2024-11-14
Description: Harbor fails to validate the user permissions when updating tag immutability policies. 

By sending a request to update a tag immutability policy with an id that belongs to a
project that the currently authenticated user doesn’t have access to, the attacker could
modify tag immutability policies configured in other projects.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-285, CWE-863
References: https://github.com/goharbor/harbor/security/advisories/GHSA-8c6p-v837-77f6
CVE: CVE-2022-31670
Published: 2024-11-14
Description: Harbor fails to validate the user permissions when updating tag retention policies. 

By sending a request to update a tag retention policy with an id that belongs to a project that the currently authenticated user doesn’t have access to, the attacker could modify
tag retention policies configured in other projects.
CVSS Score: 7.7 (HIGH)
CWE: CWE-285, CWE-863
References: https://github.com/goharbor/harbor/security/advisories/GHSA-3637-v6vq-xqqw
CVE: CVE-2022-31671
Published: 2024-11-14
Description: Harbor fails to validate user permissions when reading and updating job execution logs through the P2P preheat execution logs. By sending a request that attempts to read/update P2P preheat execution logs and specifying different job IDs, malicious authenticated users could read all the job logs stored in the Harbor database.
CVSS Score: 7.4 (HIGH)
CWE: CWE-285, CWE-863
References: https://github.com/goharbor/harbor/security/advisories/GHSA-3wpx-625q-22j7; https://github.com/goharbor/harbor/security/advisories/GHSA-q76q-q8hw-hmpw
CVE: CVE-2023-4458
Published: 2024-11-14
Description: A flaw was found within the parsing of extended attributes in the kernel ksmbd module. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this to disclose sensitive information on affected installations of Linux. Only systems with ksmbd enabled are vulnerable to this CVE.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-125
References: https://access.redhat.com/security/cve/CVE-2023-4458; https://bugzilla.redhat.com/show_bug.cgi?id=2325516; https://www.zerodayinitiative.com/advisories/ZDI-24-590/
CVE: CVE-2024-3447
Published: 2024-11-14
Description: A heap-based buffer overflow was found in the SDHCI device emulation of QEMU. The bug is triggered when both `s->data_count` and the size of  `s->fifo_buffer` are set to 0x200, leading to an out-of-bound access. A malicious guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service condition.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-122
References: https://access.redhat.com/security/cve/CVE-2024-3447; https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=58813; https://bugzilla.redhat.com/show_bug.cgi?id=2274123
CVE: CVE-2024-45099
Published: 2024-11-14
Description: IBM Security ReaQta 3.12 is vulnerable to cross-site scripting. This vulnerability allows a privileged user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
CVSS Score: 3.1 (LOW)
CWE: CWE-79
References: https://www.ibm.com/support/pages/node/7172212
CVE: CVE-2024-45642
Published: 2024-11-14
Description: IBM Security ReaQta 3.12 is vulnerable to cross-site scripting. This vulnerability allows a privileged user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-942
References: https://www.ibm.com/support/pages/node/7172212
CVE: CVE-2024-45670
Published: 2024-11-14
Description: IBM Security SOAR 51.0.1.0 and earlier contains a mechanism for users to recover or change their passwords without knowing the original password, but the user account must be compromised prior to the weak recovery mechanism.
CVSS Score: 5.6 (MEDIUM)
CWE: CWE-640
References: https://www.ibm.com/support/pages/node/7172206
CVE: CVE-2024-7730
Published: 2024-11-14
Description: A heap buffer overflow was found in the virtio-snd device in QEMU. When reading input audio in the virtio-snd input callback, virtio_snd_pcm_in_cb, the function did not check whether the iov can fit the data buffer. This issue can trigger an out-of-bounds write if the size of the virtio queue element is equal to virtio_snd_pcm_status, which makes the available space for audio data zero.
CVSS Score: 7.4 (HIGH)
CWE: CWE-122
References: https://access.redhat.com/security/cve/CVE-2024-7730; https://bugzilla.redhat.com/show_bug.cgi?id=2304289
CVE: CVE-2024-10976
Published: 2024-11-14
Description: Incomplete tracking in PostgreSQL of tables with row security allows a reused query to view or change different rows from those intended.  CVE-2023-2455 and CVE-2016-2193 fixed most interaction between row security and user ID changes.  They missed cases where a subquery, WITH query, security invoker view, or SQL-language function references a table with a row-level security policy.  This has the same consequences as the two earlier CVEs.  That is to say, it leads to potentially incorrect policies being applied in cases where role-specific policies are used and a given query is planned under one role and then executed under other roles.  This scenario can happen under security definer functions or when a common user and query is planned initially and then re-used across multiple SET ROLEs.  Applying an incorrect policy may permit a user to complete otherwise-forbidden reads and modifications.  This affects only databases that have used CREATE POLICY to define a row security policy.  An attacker must tailor an attack to a particular application's pattern of query plan reuse, user ID changes, and role-specific row security policies.  Versions before PostgreSQL 17.1, 16.5, 15.9, 14.14, 13.17, and 12.21 are affected.
CVSS Score: 4.2 (MEDIUM)
CWE: CWE-1250
References: https://www.postgresql.org/support/security/CVE-2024-10976/; https://lists.debian.org/debian-lts-announce/2024/11/msg00011.html; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/