CVE Vulnerability Catalog

PHPGurukul Online Course Registration 3.1 has a SQL injection vulnerability in /check_availability.php via the cid argument. The attack can be launched remotely and the exploit is publicly available.

A vulnerability in GitLab CE/EE (versions from 16.9.6 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3) allows an authenticated user to invoke unintended server-side methods through WebSocket connections due to improper access control.

A vulnerability in the task management component of Sonatype Nexus Repository versions 3.22.1 through 3.90.2 allows an authenticated attacker with task creation permissions to execute arbitrary code, bypassing the nexus.scripts.allowCreation security control.

GitLab naprawił problem w GitLab CE/EE, który dotyczył wszystkich wersji od 12.10 przed 18.8.9, 18.9 przed 18.9.5 oraz 18.10 przed 18.10.3. Problem ten mógł pozwolić nieautoryzowanemu użytkownikowi na spowodowanie odmowy usługi z powodu niewłaściwej walidacji danych wejściowych JSON.

GitLab naprawił problem w GitLab CE/EE, który dotyczył wszystkich wersji od 13.0 przed 18.8.9, 18.9 przed 18.9.5 oraz 18.10 przed 18.10.3. Problem ten mógł pozwolić nieautoryzowanemu użytkownikowi na spowodowanie odmowy usługi poprzez wysyłanie powtarzających się zapytań GraphQL.

In Google Chrome prior to version 147.0.7727.55, insufficient input validation in WebML allows a remote attacker to perform an out-of-bounds memory write via a crafted HTML page.

Type Confusion in CSS in Google Chrome prior to 147.0.7727.55 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted Chrome Extension. (Chromium security severity: Low)

An out-of-bounds read in Blink in Google Chrome prior to 147.0.7727.55 allows a remote attacker to perform an out-of-bounds memory read via a crafted HTML page. (Severity: Low)

Integer overflow in WebRTC in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page.

An integer overflow in the Media component in Google Chrome prior to 147.0.7727.55, which could allow a remote attacker to potentially exploit heap corruption via a crafted video file. (Chromium security severity: Low)

An integer overflow in the Media component in Google Chrome prior to 147.0.7727.55, which could allow a remote attacker to potentially exploit heap corruption via a crafted video file. (Chromium security severity: Low)

Integer overflow in the Media component in Google Chrome prior to 147.0.7727.55 allows a remote attacker to potentially exploit heap corruption via a crafted video file. Chromium security severity is Low.

In Google Chrome prior to version 147.0.7727.55, insufficient data validation in the Media component allows a remote attacker to perform an out-of-bounds memory read via a crafted video file.

Google Chrome prior to version 147.0.7727.55 has insufficient validation of untrusted input in the Media component. A remote attacker who has compromised the renderer process can exploit this to execute arbitrary code inside a sandbox via a crafted HTML page. Chromium severity: Medium.

Google Chrome prior to version 147.0.7727.55 has a use-after-free vulnerability in the Media component. A remote attacker can exploit this to execute arbitrary code inside a sandbox via a crafted HTML page. Chromium severity: Medium.

Insufficient validation of untrusted input in ANGLE in Google Chrome on Mac prior to 147.0.7727.55. A remote attacker could execute arbitrary code inside a sandbox via a crafted HTML page.

Use-after-free in Navigation in Google Chrome prior to 147.0.7727.55. A remote attacker could execute arbitrary code inside a sandbox via a crafted HTML page.

Google Chrome before version 147.0.7727.55 has an out-of-bounds read and write vulnerability in V8, allowing a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.

Use-after-free in Blink in Google Chrome prior to 147.0.7727.55. A remote attacker could execute arbitrary code inside a sandbox via a crafted HTML page.

Type Confusion in V8 in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)