Incomplete in the CWE catalog · 6 CVEs mapped
The product has or supports multiple distributed components or sub-systems that are each required to keep their own local copy of shared data - such as state or cache - but the product does not ensure that all local copies remain consistent with each other.
Incomplete tracking in PostgreSQL of changes to role membership, role attributes, and database ownership allows a query to continue using cached row-level security policies after those changes require a different policy, via plan reuse. Stale policies continue until some other event invalidates the cache or connection termination ends the session. This permits a user to complete reads and modifications that were recently permitted but now forbidden. An attacker must tailor an attack to a particular application's pattern of privilege removal and role-specific row security policies. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.
In KDE Connect before 1.33.0 on Android, a packet can be crafted that causes two paired devices to unpair. Specifically, it is an invalid discovery packet sent over broadcast UDP.
🚨 A caching hiccup is causing a real identity crisis! When cache is enabled, all users end up sharing the same credentials—imagine every guest at a hotel sharing one room key! 🔥 Think of a high-tech hotel where every guest receives the same room key because of a glitch in the system. Instead of keeping their own unique room, guests accidentally find themselves barging into each other’s spaces, leading to quite the mix-up! This can lead to some absolutely devastating consequences—users could unknowingly log in as someone else, accessing their sensitive information and settings. Imagine the chaos if Bob suddenly finds himself in Alice's account, changing her preferences or even worse, accessing her private messages!