CVE Vulnerability Catalog

A flaw in ansible-core: the ansible-galaxy role install command processes dependency specifications from meta/requirements.yml. Due to improper neutralization of argument delimiters, a malicious role author can inject arbitrary git configuration flags via the src field, allowing arbitrary code execution on the machine of a user who installs the role.

HCL Digital Experience is affected by an OS command injection vulnerability in the Digital Asset Management API. An attacker can execute arbitrary operating system commands, inheriting the privileges of the vulnerable application, potentially leading to a complete system takeover and data compromise.

Graphite before 1.3.15 has an integer underflow and resultant out-of-bounds write via Graphite actions, because slotat does not ensure that an offset is within the allowed slot-map range.

Moby (Docker Engine) before versions 29.5.1 and v2.0.0-beta.14 has a vulnerability where the daemon uses decompression binaries from the container's filesystem when extracting archives. A malicious image can replace these binaries, leading to arbitrary code execution with full daemon privileges.

Use-after-free in PDFium in Google Chrome prior to 149.0.7827.53. A remote attacker can execute arbitrary code inside a sandbox via a crafted PDF file.

Use-after-free vulnerability in the PDFium component of Google Chrome prior to version 149.0.7827.53. A remote attacker could execute arbitrary code inside a sandbox via a crafted PDF file.

Use-after-free in PDFium in Google Chrome prior to 149.0.7827.53. A remote attacker can execute arbitrary code inside a sandbox via a crafted PDF file.

Use-after-free vulnerability in the PDFium component of Google Chrome prior to 149.0.7827.53 allows a remote attacker to potentially exploit heap corruption via a crafted PDF file. Severity is low.

Use-after-free vulnerability in PDFium component of Google Chrome prior to 149.0.7827.53. A remote attacker can execute arbitrary code inside a sandbox via a crafted PDF file.

In Google Chrome prior to 149.0.7827.53, an inappropriate implementation in LiveCaption allows a remote attacker to potentially perform out-of-bounds memory access via malicious network traffic.

Insufficient validation of untrusted input in Reader Mode in Google Chrome on Android prior to 149.0.7827.53 allowed a local attacker to bypass navigation restrictions via a malicious file.

Inappropriate implementation in ImageCapture in Google Chrome prior to 149.0.7827.53. A remote attacker who compromised the renderer process could perform privilege escalation via a crafted HTML page.

In Google Chrome on Android prior to 149.0.7827.53, an inappropriate implementation in WebView allows a remote attacker to perform privilege escalation via a crafted HTML page.

Google Chrome prior to version 149.0.7827.53 has an out-of-bounds read vulnerability in DevTools, allowing a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Severity: Low)

Insufficient validation of untrusted input in Reading List in Google Chrome on iOS prior to 149.0.7827.53. A remote attacker who convinces a user to perform specific UI gestures can perform privilege escalation via a crafted HTML page.

Inappropriate implementation in Extensions in Google Chrome prior to 149.0.7827.53 allowed an attacker in a privileged network position to execute arbitrary code inside a sandbox via a crafted Chrome Extension. (Chromium security severity: Low)

Inappropriate implementation in Autofill in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page.

A Use-after-free vulnerability was found in Google Chrome prior to 149.0.7827.53 in the TabStrip component. A remote attacker can exploit a crafted HTML page to execute arbitrary code. (Severity: Low)

In Google Chrome prior to 149.0.7827.53, an integer overflow in GPU allows a remote attacker who compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.

Insufficient validation of untrusted input in the Storage Access API in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Severity: Low)