CVE Vulnerability Catalog

The CTL Arcade Lite plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to and including 1.0. This is due to missing or incorrect nonce validation on the 'ctl_arcade_lite_page_manage_games' page, allowing unauthenticated attackers to deactivate and activate arbitrary plugins via a forged request if they can trick a site administrator into clicking a link.

In OneFlow v0.9.0, improper input validation allows attackers to cause a segmentation fault by adding a Python sequence to native code during broadcasting or type conversion.

Combodo iTop is a web based IT service management tool. In versions on the 3.x branch prior to 3.2.2, an insecure direct object reference allows a user (e.g. with Service desk agent profile) to create a ModuleInstallation object when they shouldn't be able to do so. Version 3.2.2 fixes the issue.

BusyBox wget w wersji do 1.3.7 akceptował surowe znaki CR (0x0D)/LF (0x0A) oraz inne bajty kontrolne C0 w celu żądania HTTP, co pozwalało na podział linii żądania i wstrzykiwanie nagłówków kontrolowanych przez atakującego. Aby zachować poprawny format linii żądania HTTP/1.1, surowa spacja (0x20) w żądaniu musi być również odrzucona.

IBM Cognos Analytics Certified Containers 12.1.0 may disclose package parameter information due to the presence of hidden pages.

Inappropriate implementation in Omnibox in Google Chrome on Android prior to 142.0.7444.137. A remote attacker who convinced a user to engage in specific UI gestures could perform UI spoofing via a crafted HTML page.

Inappropriate implementation in Omnibox in Google Chrome on Android prior to 142.0.7444.137 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)

Incorrect security UI in Omnibox in Google Chrome on Android prior to 142.0.7444.59. A remote attacker who convinced a user to engage in specific UI gestures could perform UI spoofing via a crafted HTML page.

Incorrect security UI in SplitView in Google Chrome prior to 142.0.7444.59 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted domain name.

Policy bypass in Extensions in Google Chrome prior to 142.0.7444.59 allowed an attacker who convinced a user to install a malicious extension to leak cross-origin data via a crafted Chrome Extension. (Chromium security severity: Low)

Incorrect security UI in Fullscreen UI in Google Chrome prior to 142.0.7444.59. A remote attacker who convinced a user to engage in specific UI gestures could perform UI spoofing via a crafted HTML page.

Out of bounds read in WebXR in Google Chrome prior to 142.0.7444.59 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. (Chromium security severity: Medium)

Out-of-bounds read in the V8 engine in Google Chrome prior to 142.0.7444.59. A remote attacker could perform an out-of-bounds memory read via a crafted HTML page.

Inappropriate implementation in Autofill in Google Chrome prior to 142.0.7444.59. A remote attacker who convinced a user to engage in specific UI gestures could obtain potentially sensitive information from process memory.

Inappropriate implementation in App-Bound Encryption in Google Chrome on Windows prior to 142.0.7444.59 allowed a local attacker to obtain potentially sensitive information from process memory via a malicious file. (Chromium security severity: Medium)

Policy bypass in Extensions in Google Chrome prior to 142.0.7444.59 allowed an attacker who convinced a user to install a malicious extension to obtain potentially sensitive information from process memory via a crafted Chrome Extension.

Incorrect security UI in Omnibox in Google Chrome on Android prior to 142.0.7444.59 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)

A race condition in Storage in Google Chrome on Windows prior to 142.0.7444.59 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page.

Inappropriate implementation in V8 in Google Chrome prior to 142.0.7444.59 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High)

Inappropriate implementation in Extensions in Google Chrome prior to 142.0.7444.59. An attacker who convinced a user to install a malicious extension could bypass navigation restrictions via a crafted Chrome Extension.