CVE Vulnerability Catalog

Inappropriate implementation in V8 in Google Chrome prior to 150.0.7871.125 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

A Use-After-Free vulnerability in the Skia library in Google Chrome prior to 150.0.7871.125 allows a remote attacker who has compromised the renderer process to potentially escape the sandbox via a crafted HTML page. The issue is rated as High severity in the Chromium security assessment.

A Use-After-Free vulnerability in the GPU component of Google Chrome on Android prior to version 150.0.7871.125 was discovered. A remote attacker who had compromised the renderer process could exploit a crafted HTML page to perform a sandbox escape.

Insufficient validation of untrusted input in Linux Toolkit Theming in Google Chrome on Linux prior to 150.0.7871.125 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.

A heap buffer overflow vulnerability was found in the libyuv library in Google Chrome on Windows prior to version 150.0.7871.125. A remote attacker can exploit this by providing a crafted video file, leading to arbitrary code execution within the sandbox environment.

A use-after-free vulnerability was found in the Ozone component of Google Chrome prior to version 150.0.7871.125. A remote attacker could convince a user to perform specific UI gestures to potentially exploit heap corruption via a crafted HTML page.

A use-after-free vulnerability in the Ozone component of Google Chrome on Linux prior to version 150.0.7871.125 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page by convincing a user to perform specific UI gestures. The severity is rated as Critical by Chromium.

A vulnerability in Amazon AWS Load Balancer Controller before version 3.4.2, caused by incorrect behavior order in Gateway API listener-rule generation, allows an authenticated remote user to intercept, spoof, or deny another namespace's gRPC traffic on a shared Gateway via a crafted HTTPRoute resource.

A server-side request forgery (SSRF) vulnerability in the pagination component of AWS HealthLake MCP Server before version 0.0.14 allows a remote authenticated user to redirect pagination requests to an arbitrary endpoint. By crafting a malicious next_token parameter, an attacker can exfiltrate AWS temporary security credentials.

A resource allocation without limits or throttling vulnerability in .NET allows an unauthorized attacker to cause a denial of service over a network.

Code injection vulnerability in .NET Framework allows an unauthorized attacker to elevate privileges locally.

Deserialization of untrusted data in .NET allows an unauthorized attacker to execute code locally.

Resource allocation without limits or throttling in .NET Framework. An unauthorized attacker can remotely cause a denial of service (DoS).

A protection mechanism failure in .NET Framework allows an unauthorized attacker to execute code locally.

An incorrect authorization vulnerability has been discovered in .NET that allows an unauthorized attacker to bypass a security feature over a network.

Stack-based buffer overflow in .NET Framework. An unauthorized attacker can remotely cause a denial of service (DoS).

Improper link resolution before file access ('link following') in .NET allows an authorized attacker to perform tampering locally.

The .NET platform does not limit resource allocation, allowing an unauthorized attacker to perform a denial-of-service attack over a network.

Improper input type validation in .NET Framework allows an unauthorized attacker to cause a remote denial of service (DoS).

A vulnerability in Symfony affects NoPrivateNetworkHttpClient and IpUtils::PRIVATE_SUBNETS by omitting IPv6 transition prefixes (such as 6to4, NAT64, Teredo, and IPv4-compatible IPv6). This allows attacker-supplied URLs to represent private IPv4 targets in forms that IpUtils::isPrivateIp() did not block.