CVE Vulnerability Catalog

Inappropriate implementation in Editing in Google Chrome on Linux prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page.

Insufficient validation of untrusted input in the Mobile component in Google Chrome on Android prior to 151.0.7922.72 allowed a local attacker to spoof the contents of the Omnibox (URL bar) via a malicious file.

Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker who convinced a user to engage in specific UI gestures to leak cross-origin data via a crafted HTML page.

Insufficient validation of untrusted input in Clipboard in Google Chrome on Android prior to 151.0.7922.72 allowed a local attacker to leak cross-origin data via a crafted HTML page.

Inappropriate implementation in SVG in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page.

Insufficient policy enforcement in the Passwords component in Google Chrome prior to 151.0.7922.72. A remote attacker who had compromised the renderer process could leak cross-origin data via a crafted HTML page.

Inappropriate implementation in the Passwords component in Google Chrome prior to 151.0.7922.72. A remote attacker who convinced a user to engage in specific UI gestures could leak cross-origin data via a crafted HTML page.

Inappropriate implementation in Skia allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page.

GitLab CE/EE has improper authorization checks on merge request collaboration settings, allowing an authenticated user with developer role to commit changes to a project after being removed as a member. Affected versions are 10.6 through 19.0.4, 19.1 through 19.1.2, and 19.2 through 19.2.0.

The Python library joserfc versions 1.7.1 and earlier accept JWTs with trailing padding (==), which is non-conforming to JOSE specifications. This leads to token malleability, potentially allowing bypass of token revocation or anti-replay protection.

IBM WebSphere Application Server Liberty versions 17.0.0.3 through 26.0.0.8 are vulnerable to Cross-Site Request Forgery (CSRF), allowing an attacker to execute unauthorized actions on behalf of a trusted user.

In the Zephyr system, the print_coredump_hdr() function uses the 16-bit tgt_code field from a coredump header as an index into a fixed 7-element array without bounds checking. A tgt_code >= 7 causes an out-of-bounds read, potentially disclosing device memory or causing a crash.

fuse-overlayfs before version 1.17 preserves SUID and SGID mode bits in main.c during open(O_TRUNC) and truncate handling on a copied-up file, allowing a low-privileged process to leave the upper-layer file with mode 4777.

The Apache Traffic Server multiplexer plugin overruns its chunk-decode buffer on upstream input, enabling denial of service. This issue affects Apache Traffic Server from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

An insecure direct object reference vulnerability in Koollab LMS allowed an authenticated user to query the course completion progress of any other user without authorisation, disclosing private learning progress information.

An improper access control vulnerability in Koollab LMS allowed an unauthenticated attacker to read another user's name, internal identifier, scores, lesson status, lesson position, and cached lesson state via the SCORM API endpoint.

An unauthenticated attacker can forcibly terminate the session of any Koollab LMS user by knowing their email address via the login kickout endpoint, leading to denial of service.

An authenticated attacker can upload malicious content disguised as an image file via the feedback mail registration endpoint in Koollab LMS due to unrestricted image upload.

In datamodel-code-generator prior to version 0.63.0, the get_body function reuses Authorization, Cookie, and Proxy-Authorization headers when following cross-origin redirects while fetching remote schemas, potentially leaking credentials to external servers. This issue has been fixed in version 0.63.0.

The sqlite3 Ruby bindings for SQLite3 from version 2.1.0 to 2.9.4 contain a use-after-free vulnerability in callbacks used for SQLite aggregate functions. Callbacks can be freed while still referenced during aggregation, leading to memory corruption.