CVE Vulnerability Catalog

An authorization bypass vulnerability in Capgo before version 12.128.2 allows authenticated users to overwrite existing channels by reusing their names. Attackers with app.create_channel permission can exploit a logic mismatch between existence validation and upsert operations.

A vulnerability in Capgo before version 12.128.2 allows org admins to assign org-scoped RBAC roles at app scope without validating role scope compatibility, including to pending invitees. Attackers can pre-seed malformed high-privilege bindings that survive invite acceptance, enabling accepted low-privilege users to perform unauthorized privileged app actions.

Capgo before version 12.128.2 contains a path traversal vulnerability in the builder upload proxy that allows authenticated users with build permissions to bypass upload restrictions. Attackers can append traversal sequences to the upload path, which are normalized by the WHATWG URL parser, enabling access to internal administrative endpoints with the privileged BUILDER_API_KEY header and resulting in server-side privilege escalation.

The vulnerability in Capgo before version 12.128.2 is a broken object level authorization in the middlewareKey() function. It accepts the client-controlled x-limited-key-id header without validating ownership, allowing authenticated users to adopt cross-tenant limited keys. Attackers can supply another tenant's limited key ID to bypass authorization checks and access unauthorized cross-tenant resources across multiple API endpoints.

A vulnerability in Capgo before version 12.128.2 allows unauthenticated attackers to bypass authorization in the public.get_org_user_access_rbac function. By exploiting improper NULL comparison in the authorization gate, attackers can disclose RBAC role bindings and member email addresses using only a public API key.

A vulnerability in electron-updater prior to 26.15.0 allows an empty path component in the LD_LIBRARY_PATH environment variable, adding the current working directory to the dynamic linker search path. An attacker can execute arbitrary code by placing a malicious shared library in the directory from which the AppImage is launched.

A buffer overflow vulnerability has been discovered in the UTT nv518G device running firmware version nv518GV3v3.2.7-210919-161313. A remote attacker can exploit the gohead/sub_425994 component to cause a denial of service (DoS).

A vulnerability in the UTT nv518G router running firmware version nv518GV3v3.2.7-210919-161313 allows a remote attacker to cause a denial of service (DoS) via the gohead/sub_44af70 component.

A buffer overflow vulnerability has been discovered in the UTT nv518G device running firmware version nv518GV3v3.2.7-210919-161313. A remote attacker can exploit this flaw in the gohead/sub_472f08 component to cause a denial of service (DoS).

A buffer overflow vulnerability has been found in the UTT nv518G device running firmware version nv518GV3v3.2.7-210919-161313. A remote attacker can exploit the gohead/sub_447CAC component to cause a denial of service (DoS).

Inappropriate implementation in AI in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Low)

A Use-After-Free vulnerability in the Audio component of Google Chrome on Linux prior to version 150.0.7871.47 allows a remote attacker to execute arbitrary code via a crafted HTML page. The issue is rated as Low severity by the Chromium security team.

An inappropriate implementation in the CredentialProvider component of Google Chrome on Windows (prior to version 150.0.7871.47) allows a local attacker to perform OS-level privilege escalation via a malicious file. The issue is rated as low severity.

Insufficient validation of untrusted input in WebAppInstalls in Google Chrome on Windows prior to 150.0.7871.47 allowed a remote attacker to perform arbitrary read/write via a crafted HTML page.

Insufficient validation of untrusted input in the Cast component in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to perform privilege escalation via a crafted HTML page.

An inappropriate implementation in WebAppInstalls in Google Chrome on Android prior to version 150.0.7871.47 allowed a local attacker to perform UI spoofing via a malicious file. The issue is rated as low severity by Chromium.

A use-after-free vulnerability exists in WebProtect in Google Chrome prior to version 150.0.7871.47. An attacker who convinces a user to install a malicious extension can exploit this to execute arbitrary code via a crafted Chrome Extension.

A use-after-free vulnerability was found in PDFium in Google Chrome prior to version 150.0.7871.47. A remote attacker could exploit a crafted PDF file to execute arbitrary code inside a sandbox.

A use-after-free vulnerability in the Scheduling component of Google Chrome prior to version 150.0.7871.47 allows a remote attacker to execute arbitrary code within a sandbox via a crafted HTML page.

A use-after-free vulnerability in the Passwords component of Google Chrome prior to version 150.0.7871.47 was discovered. A remote attacker could potentially exploit heap corruption via a crafted HTML page.