CVE Vulnerability Catalog

An inappropriate implementation in Input in Google Chrome on Android prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page.

An uninitialized use in GPU in Google Chrome on Android prior to 148.0.7778.216 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.

Insufficient validation of untrusted input in Passwords in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to perform UI spoofing via a crafted HTML page.

In OpenStack Neutron before version 28.0.1, the tagging controller enforces plural policy action names on single-tag write operations while the defined policy rules use singular names. The mismatched names evaluate as allowed under the default policy, permitting a project reader to create and update tags on same-project resources.

In TREK before version 3.0.18, a timing discrepancy during login allows an attacker to enumerate valid user accounts. Missing users cause an immediate response (~10 ms), while existing users trigger a bcrypt comparison (~370 ms), creating a ~14× timing difference detectable without status code or body changes.

The @utcp/http library before version 1.1.2 is vulnerable to blind Server-Side Request Forgery (SSRF). The flaw is caused by a trust-boundary inconsistency between manual discovery and tool invocation, where callTool() does not revalidate the URL and OpenApiConverter blindly trusts malicious OpenAPI specs.

In AutoGPT prior to version 0.6.59, the POST /api/blocks/{block_id}/execute endpoint executes blocks without consuming any credits, regardless of the user's balance. The credit check in the graph execution path (manager.py) is never reached when blocks are called directly via the external API, allowing unlimited free execution of all blocks.

A vulnerability in Portainer Community Edition from version 2.33.0 to 2.33.7 allows writing files to arbitrary locations on the server filesystem via a crafted .tar.gz archive. The ExtractTarGz function does not prevent directory traversal, enabling overwriting of critical system files.

In Portainer Community Edition from version 2.33.0 to before 2.33.8 and 2.39.1, a missing authorization vulnerability in the GET /api/custom_templates/{id}/file endpoint allows any authenticated user to read custom template files by enumerating sequential IDs. These files may contain sensitive data such as connection strings, API tokens, or registry credentials.

A reflected cross-site scripting (XSS) vulnerability exists in URL handling. An attacker can inject malicious JavaScript code through a specially crafted link.

A vulnerability in the Kibana Fleet agent policy management feature allows privilege escalation. An authenticated user with Fleet management privileges can inject improperly validated values into a configuration override mechanism, causing Elastic Agents to be issued API keys with elevated Elasticsearch privileges.

CWE-400 vulnerability in Kibana allows a denial of service attack via excessive resource consumption. An authenticated user with viewer-level access can submit a request with an oversized input value to an analytics collections management endpoint. Kibana consumes excessive CPU and memory resources while processing the request, leading to service unavailability for all users until manual recovery.

A Server-Side Request Forgery (CWE-918) vulnerability in Kibana allows an authenticated user with connector management privileges to bypass the operator-configured connector allowlist. This can cause the Kibana server to issue outbound requests to destinations that egress controls were intended to block.

Vulnerability in Oracle REST Data Services (component: Core) affecting versions 24.2.0-26.1.0. An unauthenticated attacker with network access via HTTPS can easily exploit this flaw, causing a partial denial of service (partial DOS).

Vulnerability in Oracle REST Data Services (Core component) versions 24.2.0-26.1.0. An unauthenticated attacker with network access via HTTPS can unauthorizedly update, insert, or delete data.

Vulnerability in Oracle REST Data Services (component: General) affecting versions 24.2.0-26.1.0. An unauthenticated attacker with network access via HTTPS can easily exploit this flaw, resulting in unauthorized read access to a subset of data.

Vulnerability in Oracle REST Data Services in the Mongoapi component. An unauthenticated attacker with network access via HTTPS can gain unauthorized read access to a subset of data. Affected versions are 24.2.0-26.1.0.

W Kibana występuje niekontrolowane zużycie zasobów, które może prowadzić do odmowy usługi poprzez nadmierne przydzielanie zasobów. Użytkownik z autoryzacją może wysłać specjalnie przygotowany skompresowany ładunek żądania, który jest przetwarzany przed sprawdzeniem uprawnień, co prowadzi do nadmiernego zużycia pamięci i CPU.

W Kibana występuje niekontrolowane zużycie zasobów, które może prowadzić do odmowy usługi poprzez nadmierną alokację pamięci. Użytkownik z niskimi uprawnieniami, po uwierzytelnieniu, może spowodować, że Kibana zacznie zużywać rosnące ilości pamięci, przesyłając specjalnie przygotowany wyraz wizualizacji Timelion z głęboko zagnieżdżonymi wywołaniami funkcji.

Mantis Bug Tracker (MantisBT) to otwartoźródłowy system śledzenia problemów. W wersjach przed 2.28.2 funkcja mc_issue_update() pozwala użytkownikom z dostępem update_bug_threshold (UPDATER, z domyślnymi ustawieniami) na edytowanie, zmianę stanu widoku oraz modyfikację śledzenia czasu w notatkach błędów należących do innych użytkowników, omijając domyślny próg DEVELOPER (poziom 55) wymagany przez dedykowaną funkcję mc_issue_note_update().