CVE Vulnerability Catalog

Snipe-IT 8.6.3 and earlier contain a race condition in asset checkout paths. Two concurrent checkout requests for the same available asset can both commit, producing duplicate history rows and events, corrupting audit trail and reporting. Requires authenticated session with assets.checkout permission and precise timing. Fixed in 8.7.0.

Snipe-IT before 8.7.0 fails to check the return value of Storage::delete() in UploadedFilesController, allowing deletion requests to report success while files remain on disk. Administrators see success but physical files persist and remain accessible to those with filesystem or backup access.

Snipe-IT 8.6.3 and earlier do not check the return value of Storage::put() when writing signature and acceptance PDF files. On silent write failures, execution continues and marks acceptance as complete even though evidence files were never stored, yielding incomplete compliance artifacts. Fixed in 8.7.0.

PocketMine-MP versions before 5.39.2 fail to validate entity despawn state when processing attack packets. Attackers can exploit a race condition by attacking a disconnecting player to trigger multiple death handlers, causing duplication of inventory items and experience.

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00 contain an insertion of sensitive information into log file vulnerability. A low privileged attacker with local access could exploit it, leading to information exposure.

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00 contain an insertion of sensitive information into log file vulnerability. A low privileged attacker with local access could exploit it, leading to information exposure.

Dell SCG 5.0 Appliance before 5.36.00.16 and Dell SCG 5.0 Application before 5.36.00.00 contain an exposure of sensitive system information due to uncleared debug information. An unauthenticated attacker with physical access could exploit this, leading to information exposure.

Dell SCG 5.0 Appliance before 5.36.00.16 and Dell SCG 5.0 Application before 5.36.00.00 contain an exposure of sensitive system information due to uncleared debug information. A low privileged attacker with local access could exploit this, leading to information exposure.

KeePass versions 2.35 through 2.61.1 fail to validate KDBX header field sizes before memory allocation in the ReadHeaderField function. Attackers can craft a malicious KDBX file with excessive header field lengths to trigger allocation of gigabytes of memory, causing resource consumption and termination.

Dell SCG 5.0 Appliance before 5.36.00.16 and Dell SCG 5.0 Application before 5.36.00.00 contain an insertion of sensitive information into externally-accessible file or directory vulnerability. A low privileged attacker with local access could exploit this, leading to information exposure.

The WP Travel WordPress plugin before version 12.0.2 does not properly verify that the requester owns the booking targeted by its bank-deposit slip submission. This allows an unauthenticated attacker who knows the target customer's email address to change that customer's booking payment state and attach a file to it.

The WP Travel WordPress plugin before version 12.0.2 does not properly verify that the requester is authorized to modify the targeted booking on one branch of its bank-deposit handler. This allows an unauthenticated attacker who knows the target customer's email address to reset that customer's booking payment to an unpaid state and wipe its stored deposit-reconciliation data.

Improper access control in Watch Plugin prior to Android Watch 17 allows local attackers to access sensitive information.

Use-after-free in V8 in Google Chrome prior to 153.0.8010.36. A remote attacker who compromised the renderer process could read memory inside the sandbox via a crafted HTML page.

Incorrect authorization in PushAPI in Google Chrome prior to 153.0.8010.36. A remote attacker who compromised the renderer process could bypass web origin policy via a crafted HTML page.

Uninitialized resource in GPU in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page.

Incorrect authorization in ServiceWorker in Google Chrome before 153.0.8010.36. A remote attacker who had compromised the renderer process could bypass web origin policy via a crafted HTML page.

Missing authorization in FileSystem in Google Chrome before 153.0.8010.36. A remote attacker who had compromised the renderer process could obtain cross-origin data via a crafted HTML page.

Uninitialized resource in the GPU component in Google Chrome on Android prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Severity: Medium)

Observable discrepancy vulnerability in the Network component in Google Chrome prior to 153.0.8010.36. A remote attacker could obtain cross-origin data via a crafted HTML page.