CVE Vulnerability Catalog

Missing authorization in Storage in Google Chrome prior to 153.0.8010.52 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted PDF file. The vulnerability was rated Medium severity by Chromium.

Type confusion in V8 in Google Chrome prior to 153.0.8010.52. A remote attacker using social engineering could execute arbitrary code inside the sandbox via a crafted HTML page. (Severity: High)

Out of bounds read in DataTransfer in Google Chrome prior to 153.0.8010.52. A local attacker using social engineering could read memory outside the sandbox via a local program. (Severity: Medium)

Incorrect reference resolution in Tracing in Google Chrome on Windows prior to 153.0.8010.52. A local attacker could potentially execute arbitrary code outside the sandbox via a local program. (Severity: High)

Use after free in Dawn in Google Chrome on Android prior to 153.0.8010.52. A remote attacker could potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Severity: Critical)

Use after free in Extensions in Google Chrome prior to 153.0.8010.52. A remote attacker could execute arbitrary code outside the sandbox via a crafted Chrome extension. (Severity: High)

Buffer overflow in WebGL in Google Chrome on Android prior to 153.0.8010.52. A remote attacker could execute arbitrary code outside the sandbox via a crafted HTML page. (Severity: Critical)

Jupyter Server, the backend for Jupyter web applications, prior to version 2.21.0 copies the Referer header into a JSON header block in the 5xx request logging path without applying the token scrubbing used for the request URI. A request returning HTTP 500 whose Referer contains a token-bearing URL can write that token to server logs in plaintext.

Paella Player is a set of libraries to create a multi stream video player. Prior to Paella Player 2.12.11 (as used in Opencast prior to 19.7 and 20.2), there is a potential XSS attack through closed captions cue text. This vulnerability is fixed in 2.12.11.

Caddy in version 2.11.3 and earlier has three configuration-dependent weaknesses affecting the handler and placeholder layer. In modules/caddyhttp/rewrite/rewrite.go, Rewrite.Rewrite() can pass attacker-controlled replacement bytes through buildQueryString for a second placeholder expansion when a rewrite URI ends with a literal question mark, allowing injected environment or request-variable placeholders to disclose data and, when the file provider is registered, allowing injected file placeholders to disclose readable files. The issue is fixed in version 2.11.4.

A stored cross-site scripting vulnerability exists in the Geomap panel's MapLibre base layer. A user with the Editor role can execute arbitrary JavaScript in another user's session by hosting a malicious style configuration, enabling escalation to Org Admin.

fulgur, a tool converting untrusted HTML/CSS to PDF, prior to version 0.19.0 sliced a body-direct child whose CSS-resolved height greatly exceeds the page height into one fragment per page with no upper bound. This can lead to excessive resource consumption or process hang.

fulgur, a tool converting untrusted HTML/CSS to PDF, prior to version 0.19.0 sliced a body-direct child whose CSS-resolved height greatly exceeds the page height into one fragment per page with no upper bound. This can lead to excessive resource consumption or process hang.

HCL DevOps Deploy / HCL Launch is susceptible to an information disclosure vulnerability when processing redacted property values. If a deployment is configured with a secure property that starts with certain non-ASCII characters, the redaction engine may fail to mask subsequent ASCII secure values embedded inside insecure properties.

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

NetBox Device Type Library in the affected repository revisions has NETBOX_DT_LIBRARY_URL in tests/test_configuration.py as a free-form tracked constant that an unauthenticated pull-request author can change before the validation test harness runs. During pytest collection, tests/definitions_test.py passes the value to Repo.clone_from and create_remote("upstream").fetch(), causing blind Git smart-HTTP requests to an attacker-selected host or loading attacker-controlled tests/known-*.json validation caches. The blind request cannot set arbitrary metadata-service headers or return response bodies, and this path does not execute remote Git hooks, but substituted known data can bypass slug, module, and rack uniqueness validation. This vulnerability is fixed in commit 8980c690097e92f5028c7e6df402b327d827ecd5.

NetBox Device Type Library, a collection of community-sourced device type definitions for import into NetBox, is vulnerable due to the absence of tests/init.py and the lack of --import-mode=importlib, causing pytest prepend import mode to place the tests directory at the front of sys.path during collection. An unauthenticated contributor can add a module such as tests/git.py that shadows GitPython or tests/conftest.py, leading to arbitrary code execution on the GitHub Actions runner.

Caddy Proxy Manager enables email and password self-registration by default at /api/auth/sign-up/email. An unauthenticated remote actor can create an active account with the user role without administrator approval. The user role cannot view or modify proxy data, so the direct impact is limited to unauthorized creation of low-privilege accounts. This issue is fixed in version 1.5.1.

OpenSlide is a C library for reading whole slide image files. A behavior change in libtiff 4.7.1 causes the indirect TIFF tile path to request a full-height destination for a partial bottom tile row, allowing uninitialized heap memory to enter pixel data returned by openslide_read_region(). A crafted but valid slide can trigger the issue in TIFF-based formats other than Hamamatsu NDPI when a network service renders attacker-provided slides. This issue is fixed in OpenSlide 4.0.1 and official binary build 4.0.0.12.

ITFlow, an IT documentation, ticketing and accounting system for small MSPs, prior to version 26.07 allows an authenticated user with module_support write permission and access to a credential record to perform time-based blind SQL injection through the expires parameter of the share_generate_link handler in agent/ajax.php. The expires parameter is inserted unquoted into the MySQL INTERVAL expression, allowing conditional database queries.