CVE Vulnerability Catalog

A vulnerability in the CoreWCF library causes SAML token replay protection to be inoperative. The DefaultTokenReplayCache.TryAdd method does not reject duplicate tokens even when DetectReplayedTokens is enabled, allowing a captured token to be reused.

A vulnerability in CoreWCF prior to versions 1.8.1 and 1.9.1 causes UnixDomainSocket POSIX peer identity resolution to use non-reentrant getpwuid and getgrgid calls. Under contention, this can attribute one connection's identity to another or crash the host process.

A vulnerability in CoreWCF allows bypassing PosixIdentity authentication in services hosted on Unix Domain Sockets. An attacker can send messages without the required stream upgrade, bypassing framing-layer identity checks.

A vulnerability in CoreWCF allows an attacker with Kafka produce permissions to cause a persistent denial of service (DoS) on an endpoint. When KafkaTransportPump receives a null-value tombstone record, the service stops processing new records from the Kafka topic.

A vulnerability in CoreWCF before versions 1.8.1 and 1.9.1 allows an unauthenticated remote attacker to bypass WS-Security signature verification by placing a SOAP header before the wsse:Security header, causing the system to verify an attacker-supplied signature instead of the security header signature.

An inappropriate implementation in Navigation in Google Chrome prior to 150.0.7871.115 allowed a remote attacker to bypass site isolation via a crafted HTML page.

Insufficient policy enforcement in Navigation in Google Chrome prior to 150.0.7871.115 allowed a remote attacker to bypass site isolation via a crafted HTML page. (Chromium security severity: High)

Inappropriate implementation in Forms in Google Chrome prior to 150.0.7871.115 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page.

An inappropriate implementation in WebGL in Google Chrome prior to 150.0.7871.115 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page.

Insufficient policy enforcement in Passwords in Google Chrome prior to 150.0.7871.115 allowed a remote attacker to bypass same origin policy via a crafted HTML page. The vulnerability has a high severity rating according to Chromium security.

An uninitialized use vulnerability in the ANGLE component of Google Chrome prior to version 150.0.7871.115 allows a remote attacker to read potentially sensitive information from process memory via a crafted HTML page.

An integer overflow in the Extensions API in Google Chrome prior to 150.0.7871.115 allowed an attacker who convinced a user to install a malicious extension to perform an out-of-bounds memory read via a crafted Chrome Extension.

davenardella snap7 up to version 1.4.3 contains an out-of-bounds write vulnerability in the TS7Worker::PerformFunctionRead function. The attack requires local network access. An exploit has been published and may be used.

The vulnerability allows malicious use of a stolen cookie to modify the contents of the IP phone's webpage.

The IP phone vulnerability allows malicious input stored in configuration parameters to be rendered as content in the WebUI page. An attacker can inject malicious code that executes in the administrator's browser.

A vulnerability in Symfony UX allows XSS via the ux_icon() Twig function, which marks output as safe (is_safe=['html']) and embeds SVG source verbatim. Unsanitized local SVG files or Iconify JSON responses can contain malicious scripts, event handlers, or dangerous URL schemes.

A vulnerability in CoreWCF NetNamedPipe transport allows a local attacker to intercept network traffic by attaching to a pre-existing named pipe instance before the server fully creates it. The issue affects versions prior to 1.8.1 and 1.9.1.

In Snipe-IT prior to version 8.6.1, the GET /api/v1/{object}/selectlist endpoint lacks authorization. Any logged-in user, regardless of permissions, can retrieve a paginated list of all user accounts, exposing usernames, display names, employee numbers, and user IDs.

A SQL injection vulnerability in SOGo before version 5.12.7 allows authenticated users to execute arbitrary SQL statements via the newPassword parameter in the password change functionality.

A SQL injection vulnerability in SOGo before version 5.12.7 allows authenticated users to execute arbitrary SQL statements via the search parameter of the allContactSearch endpoint.