CVE Vulnerability Catalog

Inappropriate implementation in V8 in Google Chrome prior to 150.0.7871.46 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page.

An uninitialized use vulnerability in the ANGLE component of Google Chrome prior to 150.0.7871.46 allowed a remote attacker who had compromised the renderer process to potentially escape the sandbox via a crafted HTML page.

Insufficient validation of untrusted input in ANGLE in Google Chrome prior to 150.0.7871.46 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.

An inappropriate implementation in V8 in Google Chrome prior to 150.0.7871.46 allowed a remote attacker, after convincing a user to perform specific UI gestures, to execute arbitrary code inside a sandbox via a crafted HTML page. The issue is rated as low severity.

An inappropriate implementation in the V8 engine of Google Chrome prior to version 150.0.7871.46 allows a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. The vulnerability stems from a flaw in the V8 component.

A use-after-free vulnerability was found in the V8 engine of Google Chrome prior to version 150.0.7871.46. A remote attacker can exploit a crafted HTML page to execute arbitrary code inside a sandbox.

Insufficient validation of untrusted input in ANGLE in Google Chrome on Android prior to 150.0.7871.46 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.

An out-of-bounds write vulnerability in the ANGLE component of Google Chrome prior to version 150.0.7871.46 allowed a remote attacker who had compromised the renderer process to potentially escape the sandbox via a crafted HTML page.

An out-of-bounds write vulnerability in V8 in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.

A Use-After-Free vulnerability in V8 in Google Chrome prior to 150.0.7871.46 allows a remote attacker to potentially exploit heap corruption via a crafted HTML page.

A use-after-free vulnerability was found in the V8 engine of Google Chrome prior to version 150.0.7871.46. A remote attacker can exploit a crafted HTML page to execute arbitrary code within the sandbox.

An integer overflow in Skia in Google Chrome prior to 150.0.7871.46 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.

A heap buffer overflow in ANGLE in Google Chrome on Mac prior to 150.0.7871.46 allows a remote attacker to perform out-of-bounds memory access via a crafted HTML page.

An inappropriate implementation in the V8 engine of Google Chrome prior to version 150.0.7871.46 allows a remote attacker to execute arbitrary code within a sandbox via a crafted HTML page. The vulnerability stems from a flaw in the V8 component.

In Wagtail, a Django-based CMS, versions prior to 7.0.8, 7.3.3, and 7.4.2 contain a reflected XSS vulnerability in the dynamic image URL generator view within the admin interface. A low-privileged editor can craft a malicious URL that, when viewed by an admin, executes actions with admin credentials.

A buffer overflow vulnerability in the UTT nv518G router running firmware version nv518GV3v3.2.7-210919-161313 allows a remote attacker to cause a denial of service (DoS) via the gohead/sub_448384 component.

An improper input validation in the gazebo_ros_diff_drive.cpp component of gazebo_plugins v3.9.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted geometry_msgs::Twist message.

A NULL pointer dereference vulnerability was found in the AP4_AtomSampleTable::GetSample() function of MPC-BE before commit 4341cb3. An attacker can exploit a crafted MP4 file to cause a Denial of Service (DoS) by crashing the application.

Jodit Editor versions before 4.12.28 contain an XSS vulnerability due to bypass of the clean-html sanitizer. An attacker can use MathML or <style> as a carrier to hide a dangerous element from the sanitizer, allowing onload or onfocus events to be placed in the editor. When the application renders the editor content, JavaScript code executes without user interaction.

A vulnerability in the Tina headless CMS allows stored XSS and session takeover via unverified postMessage handlers and insufficient URL sanitization in rich-text content. An attacker can forge messages to hijack an authenticated editing session.