CVE Vulnerability Catalog

Google Chrome prior to version 148.0.7778.179 contains a use-after-free vulnerability in the QUIC component, allowing a remote attacker to execute arbitrary code inside a sandbox via malicious network traffic.

A use-after-free vulnerability in the GPU component of Google Chrome on Windows prior to version 148.0.7778.179 was discovered. A remote attacker can exploit a crafted HTML page to execute arbitrary code within a sandbox.

A critical Use-After-Free vulnerability in the WebRTC component of Google Chrome on Linux prior to version 148.0.7778.179 allows a remote attacker to execute arbitrary code via a crafted HTML page.

Local File Inclusion (LFI) vulnerability in Yii 2 (versions up to 2.0.54). The View::renderPhpFile() function overwrites the internal _file_ variable via extract(), allowing arbitrary file inclusion, potentially leading to RCE or information disclosure.

An arbitrary file read vulnerability via path traversal has been identified in Frappe framework before versions 15.105.0 and 16.15.0. The vulnerability allows an attacker to read files outside the allowed directory.

Trilium Notes versions 0.102.1 and prior, when running in an Electron environment, disables authentication for the Clipper API, allowing unauthenticated attackers on the local network to access API endpoints without password, API token, or CSRF protection. An attacker can scan ports and gain unauthorized access to data, as well as conduct phishing or compromise the local system.

A vulnerability in NVIDIA DGX OS in the factory provisioning process, where cloning a base image causes identical SSH host keys to be deployed across multiple systems. Sharing cryptographic identifiers enables host impersonation or man-in-the-middle attacks. Successful exploitation may lead to code execution, data tampering, privilege escalation, information disclosure, and denial of service.

NVIDIA BioNeMo Core for Linux contains a path traversal vulnerability when loading a malicious file. Successful exploitation could lead to code execution, denial of service, information disclosure, and data tampering.

NVIDIA BioNemo for Linux contains a deserialization of untrusted data vulnerability. A successful attack can lead to code execution, denial of service, information disclosure, and data tampering.

Vulnerability in NVIDIA TensorRT allowing an attacker to cause an out-of-bounds write. Successful exploitation might lead to data tampering.

Vulnerability in Splunk Enterprise (versions below 10.2.2 and 10.0.5) and Splunk Cloud Platform (multiple versions) allows users with access to the _internal index to view session cookies and response bodies containing sensitive data.

The Cost of Goods by PixelYourSite plugin for WordPress up to version 1.2.12 has a Stored Cross-Site Scripting (XSS) vulnerability via the 'csvdata[0][cost_of_goods_value]' parameter due to insufficient input sanitization and output escaping. An unauthenticated attacker can inject arbitrary scripts that execute whenever a user accesses an injected page.

InfoScale CmdServer before version 7.4.2 mishandles access control, potentially allowing unauthorized access.

A Cross-Site Request Forgery (CSRF) vulnerability in InfoScale v.9.1.3 Operations Manager (VIOM) allows an attacker to force a user with an active session to click a malicious HTML link, triggering unintended modifications on the VIOM web application without the user's knowledge.

Reflected XSS vulnerability in CityPLus before version V24.29750.1.0. An attacker can inject malicious script due to improper input neutralization during page generation.

A buffer overflow vulnerability exists in the EPSON L14150 FL27PB printer's RAW Printing Service (JetDirect) on TCP port 9100. A remote attacker can exploit this to execute arbitrary code.

Dell PowerFlex Manager, version(s) <=4.6.2, contain(s) an Exposure of Information Through Directory Listing vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Information exposure.

phoenix_storybook before 1.1.0 has an allocation of resources without limits vulnerability allowing unauthenticated denial-of-service via BEAM atom table exhaustion. Multiple LiveView event handlers convert user-supplied parameters to atoms without validation, and BEAM atoms are never garbage-collected, leading to permanent allocation and node abort when the atom table limit (~1,048,576 atoms) is reached.

Twig versions 2.16.x and 3.9.0 through 3.25.x contain a sandbox bypass vulnerability when using a SourcePolicyInterface. Attackers with template rendering capabilities can pass arbitrary PHP callables to sort, filter, map, and reduce filters, bypassing sandbox restrictions and executing arbitrary code.

A heap-based buffer overflow vulnerability in the Channel Splitting function of MediaArea MediaInfoLib, which could be exploited by an attacker to execute arbitrary code remotely or cause application crashes.