CVE Vulnerability Catalog

Inappropriate implementation in Custom Tabs in Google Chrome on Android prior to version 115.0.5790.98 allowed a remote attacker to leak cross-origin data via a crafted HTML page.

Inappropriate implementation in Web API Permission Prompts in Google Chrome prior to version 115.0.5790.98 allowed a remote attacker to obfuscate security UI via a crafted HTML page.

Inappropriate implementation in Picture In Picture in Google Chrome prior to version 115.0.5790.98 allowed a remote attacker to potentially spoof the contents of the Omnibox (URL bar) via a crafted HTML page.

Inappropriate implementation in WebApp Installs in Google Chrome prior to version 115.0.5790.98 allowed a remote attacker to potentially spoof the contents of the Omnibox (URL bar) via a crafted HTML page.

A Cross Site Scripting vulnerability in the Faculty Evaluation System using PHP/MySQLi v.1.0 allows an attacker to execute arbitrary code via a crafted payload to the page parameter.

A cross-site scripting (XSS) vulnerability was discovered in PHPJabbers Catering System v1.0 via the component /index.php?controller=pjAdmin&action=pjActionForgot.

There is a Cross Site Scripting (XSS) vulnerability in the 'theme' parameter of preview.php in PHPJabbers Time Slots Booking Calendar v3.3.

There is a Cross Site Scripting (XSS) vulnerability in the 'cid' parameter of preview.php in PHPJabbers Time Slots Booking Calendar v3.3. An attacker can exploit this vulnerability to inject malicious JavaScript code.

An integer overflow flaw was found in pl_glyph_name in Ghostscript, which may allow a local attacker to cause a denial of service by transforming a crafted PCL file to PDF format.

A buffer overflow flaw was found in the devn_pcx_write_rle() function in Ghostscript, which may allow a local attacker to cause a denial of service by outputting a crafted PDF file for a DEVN device.

Barebones CMS version 2.0.2 is vulnerable to Stored Cross-Site Scripting (XSS) when an authenticated user interacts with certain features on the admin panel.

A vulnerability in Firefox allows appref-ms files to be opened without warning the user that they may contain malicious code. This affects Firefox versions below 116 and Thunderbird versions below 102.14 and 115.1 on Windows.

The vulnerability allows a website to obscure the full screen notification by using a URL handled by an external program, which may lead to user confusion and potential spoofing attacks.

The Firefox updater created a directory writable by non-privileged users. When uninstalling Firefox, any files in that directory would be recursively deleted with the permissions of the uninstalling user account.

Race conditions in reference counting code were found, which could lead to potentially exploitable use-after-free vulnerabilities. This vulnerability affects Firefox < 116, Firefox ESR < 102.14, and Firefox ESR < 115.1.

In some circumstances, a stale value could have been used for a global variable in WASM JIT analysis. This resulted in incorrect compilation and a potentially exploitable crash in the content process.

CVE-2023-4045 concerns improper tracking of cross-origin tainting in Offscreen Canvas, which could allow unauthorized access to image data from other sites, violating same-origin policy.

Session tokens in RWS WorldServer 11.7.3 and earlier have low entropy, allowing for enumeration. This leads to unauthorized access to user sessions.

HashiCorp's Vault and Vault Enterprise are vulnerable to user enumeration when using the LDAP auth method. An attacker may submit requests of existent and non-existent LDAP users and observe the response from Vault to check if the account is valid on the LDAP server.

An issue in the delete function in the UserController class of jeesite v1.2.6 allows authenticated attackers to arbitrarily delete the Administrator's role information.