CVE Vulnerability Catalog

A vulnerability in Eramba Enterprise and Community edition version 3.19.1 allows a remote attacker to execute arbitrary code by manipulating the 'path' parameter in the URL.

File Upload vulnerability in Total CMS v.1.7.4 allows a remote attacker to execute arbitrary code via a crafted PHP file to the edit page function.

Inappropriate implementation in Extensions in Google Chrome prior to version 115.0.5790.170 allowed an attacker who convinced a user to install a malicious extension to inject scripts or HTML into a privileged page via a crafted Chrome Extension.

Insufficient data validation in Extensions in Google Chrome prior to version 115.0.5790.170 allowed an attacker who convinced a user to install a malicious extension to inject scripts or HTML into a privileged page via a crafted Chrome Extension.

Use after free in WebRTC in Google Chrome prior to version 115.0.5790.170 allowed a remote attacker to potentially exploit heap corruption via a crafted WebRTC session.

A use after free vulnerability in the Cast component of Google Chrome prior to version 115.0.5790.170 allows a remote attacker to potentially exploit heap corruption via a crafted HTML page.

Use after free in Blink Task Scheduling in Google Chrome prior to version 115.0.5790.170 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

In Google Chrome on Mac prior to version 115.0.5790.170, an out of bounds memory access in ANGLE allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

In Google Chrome prior to version 115.0.5790.170, there is a vulnerability in WebGL that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page.

Heap buffer overflow in Visuals in Google Chrome prior to version 115.0.5790.170 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

Type Confusion in V8 in Google Chrome prior to version 115.0.5790.170 allowed a remote attacker to perform arbitrary read/write via a crafted HTML page.

Type Confusion in V8 in Google Chrome prior to version 115.0.5790.170 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

Type Confusion in V8 in Google Chrome prior to version 115.0.5790.170 allowed a remote attacker to perform arbitrary read/write via a crafted HTML page.

An uncaught exception vulnerability exists in Control ID IDSecure 4.7.26.0 and prior, allowing attackers to cause the main web server of IDSecure to fault and crash, causing a denial of service.

The BIG-IP Edge Client Installer on macOS does not follow best practices for elevating privileges during the installation process.

A reflected XSS vulnerability exists in the BIG-IP Configuration utility that allows an attacker to run JavaScript in the context of the currently logged-in user.

A vulnerability exists in BIG-IP Edge Client for Windows and macOS due to insufficient verification of data, which may allow an attacker to modify its configured server list.

CVE-2023-38556 describes an improper input validation vulnerability in the Web Config software of SEIKO EPSON printers, allowing a remote attacker to turn off the printer.

An issue has been discovered in GitLab CE/EE affecting all versions from 9.3 before 16.0.8, from 16.1 before 16.1.3, and from 16.2 before 16.2.2. A Regular Expression Denial of Service was possible via sending crafted payloads which use ProjectReferenceFilter to the preview_markdown endpoint.

An issue has been discovered in GitLab CE/EE affecting all versions from 8.14 before 16.0.8, from 16.1 before 16.1.3, and from 16.2 before 16.2.2. A Denial of Service (DoS) attack was possible via crafted payloads using AutolinkFilter at the preview_markdown endpoint.