CVE Vulnerability Catalog

Race condition and use-after-free vulnerability in the Graphics: CanvasWebGL component of Firefox and Thunderbird. Fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

Use-after-free vulnerability in the XML component of Firefox and Thunderbird. Fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

Use-after-free vulnerability in the DOM: Bindings (WebIDL) component of Firefox and Thunderbird. It can lead to arbitrary code execution or application crash. The issue was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

Incorrect boundary conditions in the Layout component. The vulnerability was fixed in Firefox 158 and Thunderbird 158.

Use-after-free vulnerability in the Crash Reporting component of Firefox and Thunderbird. It can lead to arbitrary code execution or application crash. The issue was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

Use-after-free vulnerability in the Graphics: Canvas2D component of Firefox and Thunderbird. It can lead to arbitrary code execution or application crash. The issue was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

Use-after-free vulnerability in the Graphics: Text component of Firefox and Thunderbird. It can lead to arbitrary code execution or application crash. The issue was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

Use-after-free vulnerability in the Storage: IndexedDB component of Firefox and Thunderbird. It can lead to arbitrary code execution or application crash. The issue was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

A weakness has been identified in macrozheng mall up to 1.0.3. This vulnerability affects the function OmsPortalOrderServiceImpl of the file /order/generateOrder of the mall-portal component. Manipulation of the coupon_amount/pay_amount arguments causes business logic errors, remotely exploitable. The vendor deleted the GitHub issue for this vulnerability without explanation.

A vulnerability was identified in conductor-oss conductor up to 3.33.0-rc10. It affects some unknown functionality of the file AgentController.java of the Agentspan Agent Runtime component. The manipulation leads to server-side request forgery, remotely exploitable.

A low privileged remote attacker is able to view a list of roles that should only be accessible to administrators. This results in a low level of confidentiality breach, as no particularly sensitive information is affected.

Cross-Site request forgery (CSRF) vulnerability in AuthTake Technology Inc. Authtake allows Encryption Brute Forcing. This issue affects authtake from v1.3 before v1.4.

In conductor-oss conductor 3.22.0, the MCPService.listTools function in MCPService.java (MCP Service component) improperly handles the mcpServer argument, leading to Server-Side Request Forgery (SSRF). The attack can be initiated remotely, and the exploit has been made public.

In conductor-oss conductor 3.31.2, the ListApiToolsTask.start function in ListApiToolsTask.java (API Tool Configuration component) improperly handles the specUrl argument, leading to Server-Side Request Forgery (SSRF). The attack can be carried out remotely, and the exploit has been disclosed to the public.

In fit2cloud MeterSphere up to 3.6.9-lts, the Swagger3ParserApiDefinition.testUrlTimeout function in Swagger3ParserApiDefinition.java (Swagger3 Parser component) improperly handles the swaggerUrl argument, leading to Server-Side Request Forgery (SSRF). The attack can be carried out remotely, and the exploit is now public. The vendor was contacted but did not respond.

A vulnerability was determined in PublicCMS up to 5.202608.a. Affected by this issue is the function SafeConfigComponent.getSafeUrl of the file publiccms-core/src/main/java/com/publiccms/logic/component/config/SafeConfigComponent.java of the component pay Endpoint. Executing a manipulation of the argument returnUrl can lead to open redirect. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability has been found in SeldonIO MLServer up to 1.6.1. Affected is the function _extract_env of the file mlserver/env.py of the component environment_tarball Handler. Such manipulation leads to path traversal. The attack may be performed from remote. The vendor was contacted early about this disclosure but did not respond in any way.

A flaw has been found in DeepPavlov up to 1.7.0. This impacts the function untar of the component Model Download Handler. This manipulation causes path traversal. The attack is possible to be carried out remotely. The project was informed of the problem early through an issue report but has not responded yet.

A vulnerability was detected in MosaicML Composer up to 0.32.1. This affects the function tarball.extractall of the file composer/utils/checkpoint.py of the component Checkpoint Extraction. The manipulation results in path traversal. The attack can be executed remotely. The vendor was contacted early about this disclosure.

In Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic R20-11 (All versions < V2303), and multiple Desigo PXC/PXM devices (All versions >= V2.3), the affected product does not properly validate input bounds before accessing packet data. This could allow an unauthenticated remote attacker to trigger memory reads outside the intended packet boundaries.