CVE Vulnerability Catalog

Incorrect boundary conditions in the JavaScript Engine component. The vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, and Thunderbird 158 and 153.5.

Incorrect boundary conditions in the Layout component. The vulnerability was fixed in Firefox 158 and Thunderbird 158.

Use-after-free vulnerability in the Crash Reporting component of Firefox and Thunderbird. It can lead to arbitrary code execution or application crash. The issue was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

Sandbox escape due to uninitialized memory in the Graphics component. The vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, and Thunderbird 158 and 153.5.

Use-after-free vulnerability in the Graphics: Canvas2D component of Firefox and Thunderbird. It can lead to arbitrary code execution or application crash. The issue was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

Use-after-free vulnerability in the Graphics: Text component of Firefox and Thunderbird. It can lead to arbitrary code execution or application crash. The issue was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

An information disclosure and privilege escalation vulnerability in the Security: Process Sandboxing component. It was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

Sandbox escape due to incorrect boundary conditions in the Networking component. The vulnerability was fixed in Firefox 158, Firefox ESR 153.5, and Thunderbird 158 and 153.5.

Sandbox escape due to use-after-free in the Networking component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

Use-after-free vulnerability in the Storage: IndexedDB component of Firefox and Thunderbird. It can lead to arbitrary code execution or application crash. The issue was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

Sandbox escape, site isolation issue due to incorrect boundary conditions, use-after-free in the Networking component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

Privilege escalation in the Application Update component. The vulnerability was fixed in Firefox 158, Firefox ESR 153.5, and Thunderbird 158 and 153.5.

A security vulnerability has been detected in macrozheng mall up to 1.0.3. The issue affects the file /order/generateOrder in the Coupon Redemption component. Manipulation of the couponId argument leads to a race condition. The attack can be performed remotely but requires high complexity and is difficult to exploit. The vendor deleted the GitHub issue without explanation.

A weakness has been identified in macrozheng mall up to 1.0.3. This vulnerability affects the function OmsPortalOrderServiceImpl of the file /order/generateOrder of the mall-portal component. Manipulation of the coupon_amount/pay_amount arguments causes business logic errors, remotely exploitable. The vendor deleted the GitHub issue for this vulnerability without explanation.

A security flaw has been discovered in conductor-oss conductor up to 3.33.0-rc10. This affects the function KafkaPublishTask.start of the file kafka/src/main/java/com/netflix/conductor/contribs/tasks/kafka/KafkaPublishTask.java. The manipulation of the argument kafka_request.bootStrapServers results in server-side request forgery. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks.

A vulnerability was identified in conductor-oss conductor up to 3.33.0-rc10. It affects some unknown functionality of the file AgentController.java of the Agentspan Agent Runtime component. The manipulation leads to server-side request forgery, remotely exploitable.

A vulnerability was found in conductor-oss conductor up to 3.32.5 in the A2AService.getAgentCard function of A2AService.java, within the Agent Card Fetching component. Manipulating the agentUrl argument allows server-side request forgery, exploitable remotely. The exploit has been publicly disclosed and may be utilized.

A low privileged remote attacker is able to view a list of roles that should only be accessible to administrators. This results in a low level of confidentiality breach, as no particularly sensitive information is affected.

Cross-Site request forgery (CSRF) vulnerability in AuthTake Technology Inc. Authtake allows Encryption Brute Forcing. This issue affects authtake from v1.3 before v1.4.

A SQL injection vulnerability was identified in Payload CMS. Improper neutralization of user input in the "in" and "not_in" query parameters allows an authenticated attacker to perform SQL Injection attacks. The issue was fixed in versions 3.90.0 and 4.0.0-canary.34.