CVE Vulnerability Catalog

Use after free in Aura in Google Chrome prior to version 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.

A use after free vulnerability in Input in Google Chrome on Android prior to version 148.0.7778.168 allowed a remote attacker who compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.

Use after free in FileSystem in Google Chrome prior to version 148.0.7778.168 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially perform a sandbox escape via a crafted HTML page.

Integer overflow in Skia in Google Chrome on Windows prior to version 148.0.7778.168 allows a remote attacker who compromised the renderer process to perform an out of bounds memory write via a crafted HTML page.

Heap buffer overflow in WebML in Google Chrome prior to version 148.0.7778.168 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.

In the Fleet device management software, prior to version 4.80.1, a vulnerability in the IP extraction logic allows unauthenticated attackers to bypass API rate limits by spoofing client IP headers. This may enable brute-force login attempts or other abuses against Fleet instances exposed to the public internet.

The libsixel library has a signed integer overflow in the image-buffer doubling loop of the SIXEL parser, which can lead to an out-of-bounds heap write. This issue affects versions up to 1.8.7-r1 and is fixed in version 1.8.7-r2.

The libsixel library has a heap buffer overflow due to incorrect allocation size calculation in the sixel_encode_highcolor function. This issue affects versions from 1.8.7-r1 to 1.8.7-r2, where the lack of an upper bound for width and height allows for potential memory overwrites.

In OpenImageIO prior to versions 3.0.18.0 and 3.1.13.0, a signed 32-bit integer overflow in the SwapRGBABytes() function causes a large negative pointer offset when processing large kABGR DPX images. This results in immediate crashes and out-of-bounds reads and writes.

In OpenImageIO prior to versions 3.0.18.0 and 3.1.13.0, a signed 32-bit integer overflow in the pixel-loop index expression causes an out-of-bounds write that crashes the process.

In OpenImageIO versions prior to 3.0.18.0 and 3.1.13.0, a heap-based buffer overflow occurs due to a signed integer overflow in the QueryRGBBufferSizeInternal() function. This issue arises when processing crafted DPX image files, leading to writes outside the allocated buffer.

OpenImageIO prior to versions 3.0.18.0 and 3.1.13.0 contains a heap-based buffer overflow in the HEIF decoder, allowing out-of-bounds writes. This can lead to memory corruption and potential code execution.

OpenImageIO prior to versions 3.0.18.0 and 3.1.13.0 has a vulnerability related to buffer size calculation in jpeg2000input.cpp, leading to heap overflow. This issue occurs when the product of image dimensions exceeds the maximum value for 32-bit arithmetic, resulting in the allocation of an undersized buffer.

OpenImageIO prior to versions 3.0.18.0 and 3.1.13.0 contains a vulnerability that allows for heap overflow up to 65535 bytes due to improper clamping of run length in .pic files. The issue occurs in the code responsible for processing RLE.

OpenImageIO prior to versions 3.0.18.0 and 3.1.13.0 contains a vulnerability in sgiinput.cpp where the use of OIIO_DASSERT for bounds checking in the RLE decode loop does not function in release builds. As a result, a crafted .sgi file with RLE count exceeding scanline width causes heap buffer overflow and crash.

Timing limitations of the HRNG in RS9116 when power save mode is enabled results in predictable values.

In the Fleet device management software, prior to version 4.82.0, a vulnerability in the Windows MDM enrollment flow allows authentication tokens from any Azure AD tenant to be accepted. The issue arises from the lack of enforcement of the `aud` and `iss` claims in JWT signatures.

An authentication bypass vulnerability in Crabbox prior to v0.12.0 allows non-admin shared-token callers to impersonate other owners or organizations by spoofing identity headers.

SiYuan is a knowledge management system that prior to version 3.7.0 had security vulnerabilities related to 8 ungated APIs that could modify configuration and SQL index. Users with a valid JWT token could access these APIs, leading to unauthorized changes to server state.

Live Helper Chat is an open-source application that enables live support websites. In version 4.84v, the Live Helper Chat REST API chat update endpoint allows a REST user with lhchat/use to update a chat in a department they cannot read.