CVE Vulnerability Catalog

NMIS/BioDose V22.02 and previous versions' installation directory paths by default have insecure file permissions, which in certain deployment scenarios can enable users on client workstations to modify the program executables and libraries.

NMIS/BioDose V22.02 and previous installations using the embedded Microsoft SQL Server Express are exposed through a Windows share accessible to clients in networked installs. By default, this directory has insecure paths that allow access to the SQL Server database and configuration files, which may contain sensitive data.

NMIS/BioDose V22.02 and previous versions rely on a Microsoft SQL Server database. The SQL user account 'nmdbuser' and other created accounts by default have the sysadmin role.

NMIS/BioDose V22.02 and previous versions rely on a common SQL Server user account to access data in the database. User access in the client application is restricted by a password authentication check in the client software but the underlying database connection always has access. The latest version of NMIS/BioDose introduces an option to use Windows user authentication with the database, which would restrict this database connection.

Wtyczka DesignThemes LMS dla WordPressa jest podatna na eskalację uprawnień we wszystkich wersjach do 1.0.4 włącznie. Problem wynika z funkcji 'dtlms_register_user_front_end', która nie ogranicza ról użytkowników podczas rejestracji.

Rozszerzenie Aimeos GrapesJS CMS umożliwia edytowanie stron do tworzenia treści na podstawie rozszerzalnych komponentów. Przed wersjami 2021.10.8, 2022.10.8, 2023.10.8, 2024.10.8 i 2025.10.8, złośliwi edytorzy mogli wstrzykiwać kod Javascript, co prowadziło do ataku XSS typu stored, jeśli standardowa polityka bezpieczeństwa treści była wyłączona.

Lookyloo is a web interface that allows users to capture a website page and then display a tree of domains that call each other. Prior to 1.35.3, Lookyloo passed improperly escaped values to cells rendered in datatables using the orthogonal-data feature. It is definitely exploitable from the popup view, but it is most probably also exploitable in many other places. This vulnerability is fixed in 1.35.3.

Lookyloo is a web interface that allows users to capture a website page and then display a tree of domains that call each other. Prior to 1.35.3, a XSS vulnerability can be triggered when a user submits a list of URLs to capture, one of them contains a HTML element, and the capture fails. Then, the error field is populated with an error message that contains the bad URL they tried to capture, triggering the XSS. This vulnerability is fixed in 1.35.3.

Lookyloo is a web interface that allows users to capture a website page and then display a tree of domains that call each other. Prior to 1.35.3, there are multiple XSS due to unsafe use of f-strings in Markup. The issue requires a malicious 3rd party server responding with a JSON document containing JS code in a script element. This vulnerability is fixed in 1.35.3.

SDK Pythona MCP, znany jako `mcp` na PyPI, przed wersją 1.23.0 nie włączał domyślnie ochrony przed DNS rebinding dla serwerów opartych na HTTP. Gdy serwer MCP działa na localhost bez uwierzytelnienia, z wykorzystaniem FastMCP i transportu HTTP lub SSE, złośliwa strona może wykorzystać DNS rebinding do ominięcia ograniczeń polityki same-origin i wysyłać żądania do lokalnego serwera MCP.

SDK TypeScript dla Model Context Protocol (MCP) przed wersją 1.24.0 nie włącza domyślnie ochrony przed DNS rebinding dla serwerów opartych na HTTP. W przypadku uruchomienia serwera MCP na localhost bez uwierzytelnienia, złośliwa strona może wykorzystać DNS rebinding do ominięcia ograniczeń polityki samego pochodzenia i wysyłać żądania do lokalnego serwera MCP.

ESF-IDF to framework do rozwoju Internetu Rzeczy (IoT) firmy Espressif. W wersjach 5.5.1, 5.4.3, 5.3.4, 5.2.6, 5.1.6 i wcześniejszych, włączenie AVRCP na ESP32 i otrzymanie źle sformułowanego polecenia VENDOR DEPENDENT od urządzenia partnerskiego może spowodować, że stos Bluetooth uzyska dostęp do pamięci przed zweryfikowaniem długości bufora polecenia.

A race condition in V8 in Google Chrome prior to 143.0.7499.41 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Chromium security severity is Medium.

Bad cast in Loader in Google Chrome prior to 143.0.7499.41 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)

An inappropriate implementation in WebRTC in Google Chrome prior to 143.0.7499.41 allowed a remote attacker to perform arbitrary read/write via a crafted HTML page. Chromium security severity is Low.

Use after free in Media Stream in Google Chrome prior to 143.0.7499.41 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Low)

Google Chrome versions prior to 143.0.7499.41 contain an inappropriate implementation in Downloads. A remote attacker who convinced a user to engage in specific UI gestures can bypass download protections via a crafted HTML page. (Severity: Low)

Inappropriate implementation in Split View in Google Chrome prior to 143.0.7499.41 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted domain name. (Chromium security severity: Low)

Inappropriate implementation in Downloads in Google Chrome prior to 143.0.7499.41 allowed a local attacker to perform UI spoofing via a crafted HTML page. Severity is low.

Use after free in Digital Credentials in Google Chrome prior to 143.0.7499.41 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page.