CVE Vulnerability Catalog

Buffer overflow in ANGLE in Google Chrome on Android prior to 154.0.8037.57 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)

Buffer overflow in WebGL in Google Chrome on Android prior to 154.0.8037.57 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)

Use after free in Updater in Google Chrome on Mac prior to 154.0.8037.57 allowed a remote attacker to execute arbitrary code outside the sandbox via crafted network traffic. (Chromium security severity: Medium)

Use after free in ServiceWorker in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)

Out of bounds write in ANGLE in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

Out of bounds write in WebGL in Google Chrome on Android prior to 154.0.8037.57 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)

Use after free in ANGLE in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

Buffer overflow in Video in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

Use after free in Fullscreen in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)

A free of non-heap memory vulnerability in the Fonts component of Google Chrome prior to 154.0.8037.57. A remote attacker leveraging social engineering could potentially execute arbitrary code outside the sandbox via a crafted HTML page.

A use after free vulnerability in the AdFilter component of Google Chrome prior to 154.0.8037.57. A remote attacker could execute arbitrary code outside the sandbox via a crafted HTML page.

A use after free vulnerability in the GPU component of Google Chrome prior to 154.0.8037.57. A remote attacker could execute arbitrary code outside the sandbox via a crafted HTML page.

Buffer overflow in ANGLE in Google Chrome on Android prior to 154.0.8037.57 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page.

A buffer overflow vulnerability in the Tint component of Google Chrome on Android prior to 154.0.8037.57. A remote attacker could potentially execute arbitrary code outside the sandbox via a crafted HTML page.

A buffer overflow vulnerability in the ANGLE component of Google Chrome on Android prior to 154.0.8037.57. A remote attacker could execute arbitrary code outside the sandbox via a crafted HTML page.

A use after free vulnerability in the Views component of Google Chrome prior to 154.0.8037.57. A remote attacker could potentially execute arbitrary code outside the sandbox via a crafted HTML page.

IBM Guardium Data Protection 12.2 is vulnerable to command injection in the certificate export CLI functionality. A privileged authenticated CLI user can execute arbitrary commands with root privileges.

NetX Duo's WebSocket client resets the unmasking cursor to the first NX_PACKET each time it advances through a chained packet, while the loop's upper bound belongs to the current packet. With the standard contiguous packet-pool layout, a masked server frame split across two packets drives the XOR loop through the first packet's unused payload area and on through the second packet's NX_PACKET control block. The four-byte WebSocket masking key controls the bytes written, so the corruption is attacker-chosen rather than incidental.

Attacker model / Preconditions: a loaded TXM_MODULE_USER_MODE | TXM_MODULE_MEMORY_PROTECTION module issuing kernel dispatch calls, on a build with TX_ENABLE_EVENT_TRACE. A user-mode, memory-protected module can register an arbitrary function pointer as the global trace-full callback. The kernel calls it directly — no validation, no trampoline — from privileged kernel code when the trace buffer wraps. An invalid pointer faults the kernel (DoS). A pointer into the module's own code was observed running with kernel privilege (CONTROL.nPRIV = 0), confirmed at runtime with a register capture inside that code.

Joomla Extension - balbooa.com - Unauthenticated RCE via field shortcode injection in Balbooa Forms < 2.4.3.4 - Balbooa Forms supports administrator-defined PHP code which runs after a public form submission. The feature also supports form-field shortcodes inside that PHP. Before calling `eval()`, the component replaces each shortcode with the raw value submitted by the visitor, leading to an RCE vector. A public form must use the product's optional PHP-after-submission action and interpolate an attacker-controlled field shortcode inside a double-quoted PHP string to be vulnerable.