CVE Vulnerability Catalog

Insufficient policy enforcement in Extensions API in Google Chrome prior to version 116.0.5845.96 allowed an attacker who convinced a user to install a malicious extension to bypass an enterprise policy via a crafted HTML page.

Inappropriate implementation in Fullscreen in Google Chrome prior to version 116.0.5845.96 allowed a remote attacker to obfuscate security UI via a crafted HTML page.

Inappropriate implementation in Permission Prompts in Google Chrome prior to version 116.0.5845.96 allowed a remote attacker to obfuscate security UI via a crafted HTML page.

Inappropriate implementation in WebShare in Google Chrome on Android prior to version 116.0.5845.96 allowed a remote attacker to spoof the contents of a dialog URL via a crafted HTML page.

Inappropriate implementation in Autofill in Google Chrome on Android prior to version 116.0.5845.96 allowed a remote attacker to bypass Autofill restrictions via a crafted HTML page.

Inappropriate implementation in Color in Google Chrome prior to version 116.0.5845.96 allowed a remote attacker to obfuscate security UI via a crafted HTML page.

Inappropriate implementation in App Launcher in Google Chrome on iOS prior to version 116.0.5845.96 allowed a remote attacker to potentially spoof elements of the security UI via a crafted HTML page.

Inappropriate implementation in Fullscreen in Google Chrome on Android prior to version 116.0.5845.96 allowed a remote attacker to potentially spoof the contents of the Omnibox (URL bar) via a crafted HTML page.

The Broadcom RAID Controller web interface is vulnerable to client-side control bypass, leading to unauthorized data access for low privileged users.

Ghost is an open source content management system. Versions prior to 5.59.1 are subject to a vulnerability that allows authenticated users to upload files that are symlinks, which can lead to unauthorized reading of any files on the host operating system.

An issue in Python cpython v.3.7 allows an attacker to obtain sensitive information via the _asyncio._swap_current_task component. However, the vendor disputes this vulnerability, stating it only affects some 3.12 pre-releases.

Buffer Overflow vulnerability in faad2 v.2.10.1 allows a remote attacker to execute arbitrary code and cause a denial of service via the mp4info function in mp4read.c:1039.

Buffer Overflow vulnerability in faad2 v.2.10.1 allows a remote attacker to execute arbitrary code and cause a denial of service via the stcoin function in mp4read.c.

CVE-2023-38856 is a buffer overflow vulnerability in libxls version 1.6.2 that allows a remote attacker to execute arbitrary code and cause a denial of service via a crafted XLS file to the get_string function in xlstool.c:411.

Buffer Overflow vulnerability in libxls version 1.6.2 allows a remote attacker to execute arbitrary code and cause a denial of service via a crafted XLS file to the get_string function in xlstool.c:395.

Buffer Overflow vulnerability in libxls version 1.6.2 allows a remote attacker to execute arbitrary code and cause a denial of service via a crafted XLS file to the transcode_latin1_to_utf8 function in xlstool.c:296.

Buffer Overflow vulnerability in libxlsv version 1.6.2 allows a remote attacker to execute arbitrary code and cause a denial of service via a crafted XLS file to the xls_parseWorkBook function in xls.c:1015.

Buffer Overflow vulnerability in libxls version 1.6.2 allows a remote attacker to execute arbitrary code and cause a denial of service via a crafted XLS file to the unicode_decode_wcstombs function in xlstool.c:266.

Buffer Overflow vulnerability in libxls version 1.6.2 allows a remote attacker to execute arbitrary code and cause a denial of service via a crafted XLS file to the xls_parseWorkBook function in xls.c:1018.

Buffer Overflow vulnerability in Michaelrsweet codedoc v.3.7 allows an attacker to cause a denial of service via the codedoc.c:1742 component.