CVE Vulnerability Catalog

Use-after-free vulnerability in the Aura component of Google Chrome on Windows prior to version 149.0.7827.103. A remote attacker who had compromised the renderer process could potentially perform a sandbox escape via a crafted HTML page.

Use after free in File Input in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

Use after free in Ozone in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

bz2.BZ2Decompressor objects could be reused after a decompression error. If an application caught the resulting OSError and retried with the same decompressor, crafted input could cause the decompressor to resume from an invalid internal state and perform out-of-bounds writes to a stack buffer. This could crash the process when processing untrusted data.

Fides is an open-source privacy engineering platform. From version 2.33.0 to before 2.84.5, there is a DOM-based XSS vulnerability in fides.js via the fides_description override. This has been patched in version 2.84.5.

A race condition in OpenVPN versions 2.6.0 through 2.6.19 and 2.7_alpha1 through 2.7.1 leads to a use-after-free vulnerability during TLS session promotion. Remote attackers can exploit this to cause a server crash or leak heap memory.

Authorization bypass vulnerability in the WACRM automation engine prior to commit 73041bf. An authenticated attacker can access and modify contacts belonging to other tenants by supplying an arbitrary caller-controlled contact_id in a POST request without tenant ownership verification. The attacker can exploit a service-role client that bypasses row-level security to modify victim contact fields (name, email, company) across tenant boundaries using only a known contact UUID.

Headplane is a feature-complete Web UI for Headscale. Prior to versions 0.6.3 and 0.7.0-beta.3, Headplane was vulnerable to a path traversal / authorization bypass in the Headscale API client used by node and user rename operations. This issue has been patched in versions 0.6.3 and 0.7.0-beta.3.

Nginx Proxy Manager versions 2.9.14 through 2.15.1 contain an authenticated remote code execution vulnerability via OS command injection in the setupCertbotPlugins() function. Attackers with certificates:manage permission can store a malicious payload in the dns_provider_credentials field, which is directly interpolated into a shell command without sanitization, leading to arbitrary command execution upon backend restart.

A flaw has been found in CodeAstro Student Attendance Management System 1.0. The impacted element is an unknown function of the file /attendance-php/index.php. Executing a manipulation of the argument Username can lead to sql injection. The attack may be performed from remote. The exploit has been published and may be used.

samlify, a Node.js library for SAML SSO, prior to version 2.13.0 does not escape attribute values inserted into XML element text (e.g., <saml:AttributeValue>). A user can inject XML markup into an attribute value (e.g., email, name) and add new <saml:Attribute> elements inside the signed assertion. The IdP signs the tampered assertion and the SP accepts the injected attributes as trusted, allowing privilege escalation.

Vulnerability in Tenda F451 (versions 1.0.0.7/1.0.0.9) in the fromNatlimit function of the web management interface. Manipulation of the page argument leads to stack-based buffer overflow, enabling remote attack.

A command injection vulnerability exists in the WireGuard client configuration of Archer MR600 v2, v3, and v5 due to improper neutralization of user-controlled input in the web management interface. An authenticated attacker with administrative privileges may execute arbitrary commands when applying configuration changes. Exploitation may result in full compromise of confidentiality, integrity, and availability of the device.

A command injection vulnerability was found in Tenda F451 versions 1.0.0.7 and 1.0.0.9 in the formWriteFacMac function of /goform/WriteFacMac. The attack can be performed remotely. The exploit has been published.

A vulnerability was found in Tenda HG7, HG9 and HG10 300001138_en_xpon. This affects the function formPPPEdit of the file /boaform/formPPPEdit. The manipulation of the argument encodename results in stack-based buffer overflow. The attack can be launched remotely. The exploit has been made public and could be used.

Snipe-IT before version 8.6.0 contains a vulnerability that allows a non-admin user with only the granular `users.edit` permission to lock every admin out by editing the `activated` and `ldap_import` flags. Version 8.6.0 contains a patch.

In OpenMetadata prior to version 1.12.4, a non-admin SSO user can trigger a TEST_CONNECTION workflow and receive cleartext database password and ingestion bot JWT in the HTTP 201 response. The JWT can be reused to access sensitive APIs with bot privileges.

In the Linux kernel, the amdgpu driver fixed an issue with stale wptr mapping access that could lead to a security issue during queue creation.

In the Linux kernel's DRM driver for Intel GPUs (xe), there is missing validation of the PAT index for CPU cached memory. Using XE_COH_NONE coherency mode with CPU cached memory can lead to data leakage.

In the Linux kernel Mediatek pmdomain driver, the function scpsys_get_bus_protection_legacy() calls of_node_put() on a device node before checking for an error from syscon_regmap_lookup_by_phandle(). If an error occurs, dev_err_probe() dereferences the already freed node, leading to a use-after-free vulnerability.