CVE Vulnerability Catalog

The Broadcom RAID Controller web interface is vulnerable due to improper permissions on the log file.

The Broadcom RAID Controller web interface has a vulnerability related to an insecure default TLS configuration that supports obsolete and vulnerable TLS protocols.

The Broadcom RAID Controller web interface is vulnerable due to an insecure default TLS configuration that supports obsolete SHA1-based ciphersuites.

A vulnerability in the HPE Aruba Networking Virtual Intranet Access (VIA) client could allow malicious users to overwrite arbitrary files as NT AUTHORITY\SYSTEM. A successful exploit could create a Denial-of-Service (DoS) condition affecting the Microsoft Windows operating system boot process.

A vulnerability in the HPE Aruba Networking Virtual Intranet Access (VIA) client could allow local users to elevate privileges. Successful exploitation could allow execution of arbitrary code with NT AUTHORITY\SYSTEM privileges on the operating system.

Insufficient data validation in Systems Extensions in Google Chrome on ChromeOS prior to version 116.0.5845.120 allowed an attacker who convinced a user to install a malicious extension to bypass file restrictions via a crafted HTML page.

Insufficient policy enforcement in Extensions API in Google Chrome prior to version 116.0.5845.96 allowed an attacker who convinced a user to install a malicious extension to bypass an enterprise policy via a crafted HTML page.

Use after free in Extensions in Google Chrome prior to version 116.0.5845.96 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted HTML page.

Heap buffer overflow in Mojom IDL in Google Chrome prior to version 116.0.5845.96 allowed a remote attacker who compromised the renderer process and gained control of a WebUI process to potentially exploit heap corruption via a crafted HTML page.

A use after free vulnerability in DNS in Google Chrome prior to version 116.0.5845.96 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

Insufficient validation of untrusted input in XML in Google Chrome prior to version 116.0.5845.96 allowed a remote attacker to bypass file access restrictions via a crafted HTML page.

In Google Chrome prior to version 116.0.5845.96, a use after free vulnerability in the Audio module allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page if a user engaged in specific UI interaction.

Out of bounds memory access in V8 in Google Chrome prior to version 116.0.5845.96 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

Heap buffer overflow in Skia in Google Chrome prior to version 116.0.5845.96 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page.

Heap buffer overflow in ANGLE in Google Chrome prior to version 116.0.5845.96 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

Type confusion in V8 in Google Chrome prior to version 116.0.5845.96 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

A use after free vulnerability in the Network component of Google Chrome prior to version 116.0.5845.96 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page after eliciting a browser shutdown.

A use after free vulnerability in Device Trust Connectors in Google Chrome prior to version 116.0.5845.96 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

A missing authorization check allows an arbitrary authenticated user to perform certain operations through the API of CLA-assistant. This enables access to CLA information, including details of signatories and custom fields configured by the requester.

SQL Injection vulnerability in eVotingSystem-PHP v.1.0 allows a remote attacker to execute arbitrary code and obtain sensitive information via the user input fields.