CVE Vulnerability Catalog

Privilege elevation in Import in Google Chrome prior to 151.0.7922.173 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted file. (Chromium security severity: High)

Use after free in Chromoting in Google Chrome prior to 151.0.7922.173 allowed a remote attacker to execute arbitrary code outside the sandbox via crafted network traffic. (Chromium security severity: Critical)

CRLF Injection vulnerability in the Bandit library allows an unauthenticated remote attacker to smuggle CR, LF, or NUL characters into application-visible request headers via HTTP/2. Header validation does not check field values, allowing them to pass through unchanged. Additionally, a duplicate :authority pseudo-header is accepted, which can lead to conflicts.

A vulnerability in the Bandit library (Elixir) allows an unauthenticated attacker to pin an unbounded number of HTTP/2 stream processes via connection-level flow control. When a response exceeds the connection send window (default 65,535 bytes), the stream process blocks forever, and the queue is never purged, leading to resource exhaustion.

A flaw was found in the multicloud-operators-subscription component of Red Hat Advanced Cluster Management (RHACM). A tenant with HelmRelease create permissions can exploit this vulnerability by manipulating the `secretRef.Namespace` field. This allows the `GetSecret()` function in the HelmRelease controller to fetch sensitive credentials from any namespace, which are then sent to an attacker-controlled Helm repository.

Dockge validates a stack name only on the write path, allowing an authenticated user to use traversal sequences in the name to access directories outside the managed stacks directory. This can disclose .env or Compose files and delete directories containing a valid Compose file. With disableAuth enabled, these operations are available without authentication.

Centrifugo before version 6.9.0 allows a remote client to spoof headers such as x-trusted-user in connect, refresh, subscribe, publish, RPC, and related proxy calls when the backend relies on that header for authentication or authorization. The vulnerability arises from copying client-controlled headers into the connection context and forwarding them as trusted backend headers.

In libvips before version 8.18.3, applications using custom sources and processing untrusted PPM images can trigger a max/min error in vips_source_read_to_memory. Using VIPS_MAX instead of VIPS_MIN when selecting the read size can cause up to 4032 bytes to be written beyond the allocated buffer, leading to memory corruption or process crash.

In libvips before version 8.18.3, the old-style Radiance RLE decoder can process a repeat marker at the beginning of a scanline and read q[-1] before any prior pixel exists. This can disclose four bytes of adjacent heap data when loading a crafted Radiance image.

libvips before 8.18.3, built with libultrahdr support, can incorrectly size an output buffer in uhdrsave.c when a pipeline enlarges an incoming JPEG to a very large output before encoding a gain map. This can cause a heap buffer over-read.

In libvips before version 8.18.3, built without libtiff support but with ImageMagick support, the combined frame height can overflow while loading a crafted multi-page TIFF. Calculations multiply the per-page Ysize by n_frames without a checked bound, which can cause a heap buffer over-read and process crash.

libvips before version 8.18.3 has a vulnerability that allows a crafted many-band TIFF to evade scanline validation and cause an integer overflow, leading to out-of-bounds reads/writes, possible data disclosure, and likely crashes. Remote code execution has not been demonstrated but cannot be ruled out.

In DiceBear before version 9.4.3, the rotate, fontSize, and fontWeight options are interpolated into SVG attributes without proper XML escaping. This allows injection of arbitrary SVG markup, which can lead to script execution in the page origin if the generated avatar is embedded inline or opened as an image.

A vulnerability in the multicloud-operators-subscription component allows a tenant with permissions to create HelmRelease custom resources to bypass security controls. The HelmRelease controller processes chart templates with elevated ServiceAccount privileges without proper validation, enabling deployment of arbitrary resources across the cluster.

In Mailpit before version 1.30.4, the GET /api/v1/message/{id}/part/{partID}/thumb endpoint decodes image attachments into a full raster before checking dimensions, pixel count, or memory use. A compact image with very large dimensions can consume disproportionately large memory and CPU, potentially leading to service availability degradation.

In Mailpit before version 1.30.4, the SMTP command reader allocates the full command line before enforcing the 512-octet limit. An unauthenticated remote SMTP client can send an oversized single command line, which can lead to excessive memory consumption and reduced service availability.

OTRS Community Edition has an authenticated OS command injection vulnerability in the PGP encryption module that allows administrators to execute arbitrary commands by supplying crafted values for the PGP binary path and command options. The values are concatenated without sanitization into a shell command, enabling command execution as the web server user.

A vulnerability in the 100xdevs CMS version 1.0 allows a remote attacker to obtain sensitive information via the src/middleware.ts and src/app/api/mobile/search/route.ts components.

A single crafted SSH message gives an unauthenticated network attacker an out-of-bounds stack write of attacker-controlled length and content against any application built on swift-nio-ssh. This vulnerability is addressed in swift-nio-ssh version 0.14.1.

NoSleep 1.5.1 exposes a privileged XPC Mach service and accepts raw dictionary messages containing attacker-controlled command and NSBundlePath values. This could allow unauthorized actions on the system.