deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-49800
Published: 2023-12-09
Description: `nuxt-api-party` is an open source module to proxy API requests. The library allows the user to send many options directly to `ofetch`. There is no filter on which options are available. We can abuse the retry logic to cause the server to crash from a stack overflow. fetchOptions are obtained directly from the request body. A malicious user can construct a URL known  to not fetch successfully, then set the retry attempts to a high value, this will cause a stack overflow as ofetch error handling works recursively resulting in a denial of service. This issue has been addressed in version 0.22.1. Users are advised to upgrade. Users unable to upgrade should limit ofetch options.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400, CWE-674, CWE-787
References: https://github.com/johannschopplich/nuxt-api-party/security/advisories/GHSA-q6hx-3m4p-749h; https://github.com/johannschopplich/nuxt-api-party/security/advisories/GHSA-q6hx-3m4p-749h
CVE: CVE-2023-6560
Published: 2023-12-09
Description: An out-of-bounds memory access flaw was found in the io_uring SQ/CQ rings functionality in the Linux kernel. This issue could allow a local user to crash the system.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-823, CWE-119
References: http://packetstormsecurity.com/files/176405/io_uring-__io_uaddr_map-Dangerous-Multi-Page-Handling.html; https://access.redhat.com/security/cve/CVE-2023-6560; https://bugzilla.redhat.com/show_bug.cgi?id=2253249
CVE: CVE-2023-49797
Published: 2023-12-09
Description: PyInstaller bundles a Python application and all its dependencies into a single package. A PyInstaller built application, elevated as a privileged process, may be tricked by an unprivileged attacker into deleting files the unprivileged user does not otherwise have access to. A user is affected if **all** the following are satisfied: 1. The user runs an application containing either `matplotlib` or `win32com`. 2. The application is ran as administrator (or at least a user with higher privileges than the attacker). 3. The user's temporary directory is not locked to that specific user (most likely due to `TMP`/`TEMP` environment variables pointing to an unprotected, arbitrary, non default location). Either: A. The attacker is able to very carefully time the replacement of a temporary file with a symlink. This switch must occur exactly between `shutil.rmtree()`'s builtin symlink check and the deletion itself B: The application was built with Python 3.7.x or earlier which has no protection against Directory Junctions links. The vulnerability has been addressed in PR #7827 which corresponds to `pyinstaller >= 5.13.1`. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-379, CWE-732, CWE-732
References: https://github.com/pyinstaller/pyinstaller/pull/7827; https://github.com/pyinstaller/pyinstaller/security/advisories/GHSA-9w2p-rh8c-v9g5; https://github.com/python/cpython/blob/0fb18b02c8ad56299d6a2910be0bab8ad601ef24/Lib/shutil.py#L623
CVE: CVE-2020-25835
Published: 2023-12-09
Description: A potential vulnerability has been identified in Micro Focus ArcSight Management Center. The vulnerability could be remotely exploited resulting in stored Cross-Site Scripting (XSS).

CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://community.microfocus.com/cfs-file/__key/communityserver-wikis-components-files/00-00-00-00-29/5037.ArcMC_5F00_RelNotes_5F00_2_2D00_9_2D00_6.pdf; https://community.microfocus.com/cfs-file/__key/communityserver-wikis-components-files/00-00-00-00-29/5037.ArcMC_5F00_RelNotes_5F00_2_2D00_9_2D00_6.pdf
CVE: CVE-2023-6394
Published: 2023-12-09
Description: A flaw was found in Quarkus. This issue occurs when receiving a request over websocket with no role-based permission specified on the GraphQL operation, Quarkus processes the request without authentication despite the endpoint being secured. This can allow an attacker to access information and functionality outside of normal granted API permissions.
CVSS Score: 7.4 (HIGH)
CWE: CWE-862, CWE-862
References: https://access.redhat.com/errata/RHSA-2023:7612; https://access.redhat.com/errata/RHSA-2023:7700; https://access.redhat.com/security/cve/CVE-2023-6394
CVE: CVE-2023-28523
Published: 2023-12-09
Description: 
IBM Informix Dynamic Server 12.10 and 14.10 onsmsync is vulnerable to a heap buffer overflow, caused by improper bounds checking which could allow an attacker to execute arbitrary code.  IBM X-Force ID:  250753.


CVSS Score: 8.4 (HIGH)
CWE: CWE-122, CWE-787
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/250753; https://www.ibm.com/support/pages/node/7070188; https://exchange.xforce.ibmcloud.com/vulnerabilities/250753
CVE: CVE-2023-28526
Published: 2023-12-09
Description: 
IBM Informix Dynamic Server 12.10 and 14.10 archecker is vulnerable to a heap buffer overflow, caused by improper bounds checking which could allow a local user to cause a segmentation fault.  IBM X-Force ID:  251204.


CVSS Score: 6.2 (MEDIUM)
CWE: CWE-122, CWE-787
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/251204; https://www.ibm.com/support/pages/node/7070188; https://exchange.xforce.ibmcloud.com/vulnerabilities/251204
CVE: CVE-2023-28527
Published: 2023-12-09
Description: 
IBM Informix Dynamic Server 12.10 and 14.10 cdr is vulnerable to a heap buffer overflow, caused by improper bounds checking which could allow a local user to cause a segmentation fault. IBM X-Force ID: 251206.


CVSS Score: 6.2 (MEDIUM)
CWE: CWE-122, CWE-787
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/251206; https://www.ibm.com/support/pages/node/7070188; https://exchange.xforce.ibmcloud.com/vulnerabilities/251206
CVE: CVE-2023-47722
Published: 2023-12-09
Description: IBM API Connect V10.0.5.3 and V10.0.6.0 stores user credentials in browser cache which can be read by a local user.  IBM X-Force ID:  271912.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-522
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/271912; https://www.ibm.com/support/pages/node/7087806; https://exchange.xforce.ibmcloud.com/vulnerabilities/271912
CVE: CVE-2023-47465
Published: 2023-12-09
Description: An issue in GPAC v.2.2.1 and before allows a local attacker to cause a denial of service (DoS) via the ctts_box_read function of file src/isomedia/box_code_base.c.
CVSS Score: 5.5 (MEDIUM)
References: https://github.com/gpac/gpac/issues/2652; https://github.com/gpac/gpac/issues/2652
CVE: CVE-2023-28868
Published: 2023-12-09
Description: Support Assistant in NCP Secure Enterprise Client before 12.22 allows attackers to delete arbitrary files on the operating system by creating a symbolic link.
CVSS Score: 8.1 (HIGH)
CWE: CWE-59
References: https://herolab.usd.de/en/security-advisories/usd-2022-0002/; https://herolab.usd.de/en/security-advisories/usd-2022-0002/
CVE: CVE-2023-28869
Published: 2023-12-09
Description: Support Assistant in NCP Secure Enterprise Client before 12.22 allows attackers read the contents of arbitrary files on the operating system by creating a symbolic link.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-59
References: https://herolab.usd.de/en/security-advisories/usd-2022-0003/; https://herolab.usd.de/en/security-advisories/usd-2022-0003/
CVE: CVE-2023-28870
Published: 2023-12-09
Description: Insecure File Permissions in Support Assistant in NCP Secure Enterprise Client before 12.22 allow attackers to write to configuration files from low-privileged user accounts.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-276
References: https://herolab.usd.de/en/security-advisories/usd-2022-0004/; https://herolab.usd.de/en/security-advisories/usd-2022-0004/
CVE: CVE-2023-28871
Published: 2023-12-09
Description: Support Assistant in NCP Secure Enterprise Client before 12.22 allows attackers to read registry information of the operating system by creating a symbolic link.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-59
References: https://herolab.usd.de/en/security-advisories/usd-2022-0005/; https://herolab.usd.de/en/security-advisories/usd-2022-0005/
CVE: CVE-2023-28873
Published: 2023-12-09
Description: An XSS issue in wiki and discussion pages in Seafile 9.0.6 allows attackers to inject JavaScript into the Markdown editor.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://herolab.usd.de/en/security-advisories/usd-2022-0032/; https://manual.seafile.com/changelog/server-changelog/#908-2022-09-07; https://herolab.usd.de/en/security-advisories/usd-2022-0032/
CVE: CVE-2023-28874
Published: 2023-12-09
Description: The next parameter in the /accounts/login endpoint of Seafile 9.0.6 allows attackers to redirect users to arbitrary sites.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: https://herolab.usd.de/en/security-advisories/usd-2022-0033/; https://manual.seafile.com/changelog/server-changelog/#908-2022-09-07; https://herolab.usd.de/en/security-advisories/usd-2022-0033/
CVE: CVE-2023-46932
Published: 2023-12-09
Description: Heap Buffer Overflow vulnerability in GPAC version 2.3-DEV-rev617-g671976fcc-master, allows attackers to execute arbitrary code and cause a denial of service (DoS) via str2ulong class in src/media_tools/avilib.c in gpac/MP4Box.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-787
References: https://github.com/gpac/gpac/issues/2669; https://github.com/gpac/gpac/issues/2669
CVE: CVE-2023-5756
Published: 2023-12-09
Description: The Digital Publications by Supsystic plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.7.6. This is due to missing or incorrect nonce validation on the AJAX action handler. This makes it possible for unauthenticated attackers to execute AJAX actions via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://plugins.trac.wordpress.org/browser/digital-publications-by-supsystic/trunk/classes/frame.php#L144; https://plugins.trac.wordpress.org/changeset/3010075; https://www.wordfence.com/threat-intel/vulnerabilities/id/2304e4dc-0dc6-4ded-b8e6-8d76d70f63d7?source=cve
CVE: CVE-2023-6120
Published: 2023-12-09
Description: The Welcart e-Commerce plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.9.6 via the upload_certificate_file function. This makes it possible for administrators to upload .pem or .crt files to arbitrary locations on the server.
CVSS Score: 4.1 (MEDIUM)
CWE: CWE-22, CWE-22
References: https://plugins.trac.wordpress.org/changeset/2992785/usc-e-shop/trunk/classes/paymentPaygent.class.php?contextall=1&old=2880236&old_path=%2Fusc-e-shop%2Ftrunk%2Fclasses%2FpaymentPaygent.class.php; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2999846%40usc-e-shop%2Ftrunk&old=2996147%40usc-e-shop%2Ftrunk&sfp_email=&sfph_mail=#file1; https://www.wordfence.com/threat-intel/vulnerabilities/id/2677cea6-d60d-4e10-afd7-e088a5592b19?source=cve
CVE: CVE-2023-47254
Published: 2023-12-09
Description: An OS Command Injection in the CLI interface on DrayTek Vigor167 version 5.2.2, allows remote attackers to execute arbitrary system commands and escalate privileges via any account created within the web interface.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2023-023.txt; https://www.syss.de/pentest-blog/command-injection-via-cli-des-draytek-vigor167-syss-2023-023; https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2023-023.txt
CVE: CVE-2021-46899
Published: 2023-12-09
Description: SyncTrayzor 1.1.29 enables CEF (Chromium Embedded Framework) remote debugging, allowing a local attacker to control the application.
CVSS Score: 7.8 (HIGH)
References: https://github.com/canton7/SyncTrayzor/issues/666; https://github.com/canton7/SyncTrayzor/releases; https://github.com/canton7/SyncTrayzor/issues/666
CVE: CVE-2023-50428
Published: 2023-12-09
Description: In Bitcoin Core through 26.0 and Bitcoin Knots before 25.1.knots20231115, datacarrier size limits can be bypassed by obfuscating data as code (e.g., with OP_FALSE OP_IF), as exploited in the wild by Inscriptions in 2022 and 2023. NOTE: although this is a vulnerability from the perspective of the Bitcoin Knots project, some others consider it "not a bug."
CVSS Score: 5.3 (MEDIUM)
References: https://en.bitcoin.it/wiki/Common_Vulnerabilities_and_Exposures; https://github.com/bitcoin/bitcoin/blob/65c05db660b2ca1d0076b0d8573a6760b3228068/src/kernel/mempool_options.h#L46-L53; https://github.com/bitcoin/bitcoin/pull/28408#issuecomment[PII_REDACTED]
CVE: CVE-2023-50429
Published: 2023-12-09
Description: IzyBat Orange casiers before 20230803_1 allows getEnsemble.php ensemble SQL injection.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-89
References: https://github.com/orangecertcc/security-research/security/advisories/GHSA-mc3w-rv8p-f9xf; https://github.com/orangecertcc/security-research/security/advisories/GHSA-mc3w-rv8p-f9xf
CVE: CVE-2023-50430
Published: 2023-12-09
Description: The Goodix Fingerprint Device, as shipped in Dell Inspiron 15 computers, does not follow the Secure Device Connection Protocol (SDCP) when enrolling via Linux, and accepts an unauthenticated configuration packet to select the Windows template database, which allows bypass of Windows Hello authentication by enrolling an attacker's fingerprint.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-287
References: https://blackwinghq.com/blog/posts/a-touch-of-pwn-part-i/; https://blackwinghq.com/blog/posts/a-touch-of-pwn-part-i/
CVE: CVE-2023-6646
Published: 2023-12-09
Description: A vulnerability classified as problematic has been found in linkding 1.23.0. Affected is an unknown function. The manipulation of the argument q leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.23.1 is able to address this issue. It is recommended to upgrade the affected component. VDB-247338 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early, responded in a very professional manner and immediately released a fixed version of the affected product.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/sissbruecker/linkding/releases/tag/v1.23.1; https://treasure-blarney-085.notion.site/linkding-XSS-12709fa5ec664c8ebf6a4a02141252a8; https://vuldb.com/?ctiid.247338
CVE: CVE-2023-50431
Published: 2023-12-09
Description: sec_attest_info in drivers/accel/habanalabs/common/habanalabs_ioctl.c in the Linux kernel through 6.6.5 allows an information leak to user space because info->pad0 is not initialized.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=a9f07790a4b2250f0140e9a61c7f842fd9b618c7; https://lists.freedesktop.org/archives/dri-devel/2023-November/431772.html; https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=a9f07790a4b2250f0140e9a61c7f842fd9b618c7
CVE: CVE-2023-6647
Published: 2023-12-10
Description: A vulnerability, which was classified as critical, has been found in AMTT HiBOS 1.0. Affected by this issue is some unknown functionality. The manipulation of the argument Type leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-247340. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 7.3 (HIGH)
CWE: CWE-89
References: https://github.com/gatsby2003/Sqlinjection/blob/main/sql.md; https://vuldb.com/?ctiid.247340; https://vuldb.com/?id.247340
CVE: CVE-2023-6648
Published: 2023-12-10
Description: A vulnerability, which was classified as critical, was found in PHPGurukul Nipah Virus Testing Management System 1.0. This affects an unknown part of the file password-recovery.php. The manipulation of the argument username/contactno leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/dhabaleshwar/niv_testing_sqliforgotpassword/blob/main/exploit.md; https://phpgurukul.com/; https://vuldb.com/?ctiid.247341
CVE: CVE-2023-6649
Published: 2023-12-10
Description: A vulnerability has been found in PHPGurukul Teacher Subject Allocation Management System 1.0 and classified as problematic. This vulnerability affects unknown code of the file index.php. The manipulation of the argument searchdata with the input <script>alert(5)</script> leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-247342 is the identifier assigned to this vulnerability.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: https://github.com/dhabaleshwar/Open-Source-Vulnerabilities/blob/main/tsas-reflected-xss.md; https://vuldb.com/?ctiid.247342; https://vuldb.com/?id.247342
CVE: CVE-2023-6650
Published: 2023-12-10
Description: A vulnerability was found in SourceCodester Simple Invoice Generator System 1.0 and classified as problematic. This issue affects some unknown processing of the file login.php. The manipulation of the argument cashier leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-247343.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: https://github.com/x1280/CVE/blob/main/Cross-site%20Scriping_cashier.md; https://vuldb.com/?ctiid.247343; https://vuldb.com/?id.247343
CVE: CVE-2023-6651
Published: 2023-12-10
Description: A vulnerability was found in code-projects Matrimonial Site 1.0. It has been classified as critical. Affected is an unknown function of the file /auth/auth.php?user=1. The manipulation of the argument username leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-247344.
CVSS Score: 7.3 (HIGH)
CWE: CWE-89
References: https://github.com/850362564/BugHub/blob/main/Matrimonial%20Site%20System%20auth.php%20has%20Sqlinjection.pdf; https://vuldb.com/?ctiid.247344; https://vuldb.com/?id.247344
CVE: CVE-2023-6652
Published: 2023-12-10
Description: A vulnerability was found in code-projects Matrimonial Site 1.0. It has been declared as critical. Affected by this vulnerability is the function register of the file /register.php. The manipulation leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-247345 was assigned to this vulnerability.
CVSS Score: 7.3 (HIGH)
CWE: CWE-89
References: https://github.com/sweatxi/BugHub/blob/main/Matrimonial%20Site%20System%20functions.php%20%20has%20Sqlinjection.pdf; https://vuldb.com/?ctiid.247345; https://vuldb.com/?id.247345
CVE: CVE-2023-6653
Published: 2023-12-10
Description: A vulnerability was found in PHPGurukul Teacher Subject Allocation Management System 1.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /admin/subject.php of the component Create a new Subject. The manipulation of the argument cid leads to cross-site request forgery. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-247346 is the identifier assigned to this vulnerability.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://github.com/dhabaleshwar/Open-Source-Vulnerabilities/blob/main/csrf_add_sub.md; https://vuldb.com/?ctiid.247346; https://vuldb.com/?id.247346
CVE: CVE-2023-6654
Published: 2023-12-10
Description: A vulnerability classified as critical was found in PHPEMS 6.x/7.x/8.x/9.0. Affected by this vulnerability is an unknown functionality in the library lib/session.cls.php of the component Session Data Handler. The manipulation leads to deserialization. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-247357 was assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-502
References: https://note.zhaoj.in/share/jw4Hp9cq7T69; https://vuldb.com/?ctiid.247357; https://vuldb.com/?id.247357
CVE: CVE-2023-6655
Published: 2023-12-10
Description: A vulnerability, which was classified as critical, has been found in Hongjing e-HR 2020. Affected by this issue is some unknown functionality of the file /w_selfservice/oauthservlet/%2e./.%2e/general/inform/org/loadhistroyorgtree of the component Login Interface. The manipulation of the argument parentid leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-247358 is the identifier assigned to this vulnerability.
CVSS Score: 7.3 (HIGH)
CWE: CWE-89
References: https://github.com/willchen0011/cve/blob/main/HongJing-sql.md; https://vuldb.com/?ctiid.247358; https://vuldb.com/?id.247358
CVE: CVE-2023-50446
Published: 2023-12-10
Description: An issue was discovered in Mullvad VPN Windows app before 2023.6-beta1. Insufficient permissions on a directory allow any local unprivileged user to escalate privileges to SYSTEM.
CVSS Score: 7.8 (HIGH)
CWE: CWE-732
References: https://github.com/mullvad/mullvadvpn-app/pull/5398; https://github.com/mullvad/mullvadvpn-app/releases/tag/2023.6; https://github.com/mullvad/mullvadvpn-app/releases/tag/2023.6-beta1
CVE: CVE-2023-50449
Published: 2023-12-10
Description: JFinalCMS 5.0.0 could allow a remote attacker to read files via ../ Directory Traversal in the /common/down/file fileKey parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://gitee.com/heyewei/JFinalcms/issues/I7WGC6; https://gitee.com/heyewei/JFinalcms/issues/I7WGC6
CVE: CVE-2023-5868
Published: 2023-12-10
Description: A memory disclosure vulnerability was found in PostgreSQL that allows remote users to access sensitive information by exploiting certain aggregate function calls with 'unknown'-type arguments. Handling 'unknown'-type values from string literals without type designation can disclose bytes, potentially revealing notable and confidential information. This issue exists due to excessive data output in aggregate function calls, enabling remote users to read some portion of system memory.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-686
References: https://access.redhat.com/errata/RHSA-2023:7545; https://access.redhat.com/errata/RHSA-2023:7579; https://access.redhat.com/errata/RHSA-2023:7580
CVE: CVE-2023-5869
Published: 2023-12-10
Description: A flaw was found in PostgreSQL that allows authenticated database users to execute arbitrary code through missing overflow checks during SQL array value modification. This issue exists due to an integer overflow during array modification where a remote user can trigger the overflow by providing specially crafted data. This enables the execution of arbitrary code on the target system, allowing users to write arbitrary bytes to memory and extensively read the server's memory.
CVSS Score: 8.8 (HIGH)
CWE: CWE-190, CWE-190
References: https://access.redhat.com/errata/RHSA-2023:7545; https://access.redhat.com/errata/RHSA-2023:7579; https://access.redhat.com/errata/RHSA-2023:7580
CVE: CVE-2023-5870
Published: 2023-12-10
Description: A flaw was found in PostgreSQL involving the pg_cancel_backend role that signals background workers, including the logical replication launcher, autovacuum workers, and the autovacuum launcher. Successful exploitation requires a non-core extension with a less-resilient background worker and would affect that specific background worker only. This issue may allow a remote high privileged user to launch a denial of service (DoS) attack.
CVSS Score: 2.2 (LOW)
CWE: CWE-400
References: https://access.redhat.com/errata/RHSA-2023:7545; https://access.redhat.com/errata/RHSA-2023:7579; https://access.redhat.com/errata/RHSA-2023:7580