CVE Vulnerability Catalog

kas, a setup tool for bitbake based projects, prior to 5.4, internal SSH key setup triggered by SSH_PRIVATE_KEY or SSH_PRIVATE_KEY_FILE creates ~/.ssh/config when no user-specific SSH configuration exists and adds a global Host * rule containing StrictHostKeyChecking no. In kas/libcmds.py, ssh_no_host_key_check() runs without checking ctx.managed_env, so the setting persists after kas exits and affects future SSH sessions by the same local user, extending beyond the intended short-lived continuous integration environment. A later SSH connection can therefore accept an attacker-controlled host key without verification, increasing the risk of a man-in-the-middle attack that compromises session confidentiality or integrity.

A vulnerability in the LoRaWAN TS004 Fragmented Data Block Transport handler frag_transport_package_callback() in Zephyr RTOS (subsys/lorawan/services/frag_transport.c) lacks validation of remaining payload bytes before each access. An attacker with session keys can cause an out-of-bounds read (up to ~232 bytes) past the RxPayload buffer, copying adjacent static memory into decoder buffers and the FUOTA flash image.

The LoRaWAN application-layer clock-synchronization service has an out-of-bounds read vulnerability in the AppTimeAns command handler. Missing length check causes up to 5 bytes to be read past the decrypted payload, potentially applying a garbage time correction.

GitLab has remediated an issue in GitLab EE affecting all versions from 13.1 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 that, under certain conditions, an authenticated user with reporter-role permissions who authored a merge request could have reset merge request approval rules due to improper authorization checks.

The personal access token removal query selects from PersonalAccessTokenDB but filters on columns of Session, with no join between them. SQLAlchemy resolves that as an implicit cross join, so the filter does not constrain the delete to the calling user's own token. This way a user can delete all personal access tokens in the system.

A control logic defect in a specific built-in webpage of Kids Mode allows users to view local gallery photos directly within the page.

A pop-up logic flaw in a certain feature of Kids Mode allows users to bypass password verification and use Quick Apps outside the app.

The Forminator Forms WordPress plugin before version 1.57.1 does not verify that site registration is enabled on the network before creating a site signup. This allows unauthenticated visitors to create a new site on a WordPress multisite network and gain administrator privileges on it.

The SMM IHISI command handler, FMTSWriteUseIntelLib, for FMTS command 0x32, reads and writes data without checking buffer size and could cause buffer overflow.

Kimai before 2.53.0 fails to block sensitive User methods in the Twig invoice template sandbox, allowing admins to call getApiToken() and getPlainApiToken() methods. Attackers with template creation permissions can embed these method calls in invoice templates to leak hashed API tokens in rendered invoice output.

Kimai before 2.54.0 has a timing oracle vulnerability in TokenAuthenticator that allows unauthenticated attackers to enumerate valid usernames via the X-AUTH-USER header. Response time differences reveal account existence.

Improper control of a resource through its lifetime in Workers in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: Low)

Improper input validation in FindInPage in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Severity: Medium)

Improper input validation in WebRTC in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)

Incorrect authorization in SiteIsolation in Google Chrome before 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass site isolation into a privileged page via a crafted HTML page.

Improper input validation in DevTools in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Severity: Medium)

Incorrect authorization in the SiteIsolation component of Google Chrome prior to 152.0.7977.65. A remote attacker who compromised the renderer process and leveraged social engineering can bypass site isolation via a crafted HTML page.

Incorrect authorization in the Network component of Google Chrome prior to 152.0.7977.65. A remote attacker who compromised the renderer process can bypass site isolation via a crafted HTML page.

Incorrect reference resolution in the Speech component in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Severity: Medium)

Improper input validation in Navigation in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: Medium)