CVE Vulnerability Catalog

In OpenChoreo from 1.0.0 until 1.0.6, 1.1.7, and 1.2.5, the PUT .../workflowruns/{runName} update route authorizes a request using project and component labels in the submitted body while selecting the stored WorkflowRun by the URL path. An authenticated caller with workflowrun:update can rewrite ownership labels of another run in the same namespace, gaining access to logs, events, deletion, or parameter modification.

In virtualenv prior to 21.13.0, the bash activate script that zsh also sources leaves the environment name unescaped; from 21.13.0 until 21.14.4, it escapes backslashes, dollar signs, and backticks only when BASH_VERSION is set, so zsh receives the raw value assigned to PS1. In zsh with PROMPT_SUBST, an attacker-influenced value containing expansion syntax can execute commands each time the prompt is drawn.

In a2aproject a2a-rs up to 0.4.3, the HttpPushSender function in crates/server/src/push_notification_sender.rs (Push Notification Handler component) allows manipulation of the TaskPushNotificationConfig argument, leading to server-side request forgery. The attack may be launched remotely, and the patch is commit 2ba50176ea9f222d9a7d0f0e8cfe6fae7cf4c224.

Improper state validation in the Performance component of Google Chrome prior to version 156.0.8078.47. A local attacker could read memory via a local program.

Incorrect authorization in the Sandbox component of Google Chrome prior to version 156.0.8078.47. A remote attacker who had compromised the renderer process could potentially execute arbitrary code outside the sandbox via a crafted HTML page.

Use after free in SVG in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page.

Use-after-free vulnerability in the Turbolev component of Google Chrome prior to 156.0.8078.47. A remote attacker could execute arbitrary code inside the sandbox via a crafted HTML page.

Use after free in Scroll in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page.

Race condition in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted Chrome extension.

Buffer overflow in ANGLE in Google Chrome on Windows prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page.

Uninitialized resource in GPU in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page.

Observable discrepancy in Controls in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page.

Incorrect authorization in the CustomTabs component of Google Chrome on Android prior to version 156.0.8078.47. A local attacker could obtain cross-origin data via a co-installed app.

Missing authorization in Chromecast in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to obtain sensitive information via a crafted HTML page.

Uninitialized resource in GPU in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page.

UI misrepresentation in Chrome for iOS prior to 156.0.8078.47 allowed a remote attacker to spoof UI elements via a crafted HTML page.

Missing authorization in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to obtain cross-origin data via a crafted Chrome extension.

UI misrepresentation in Navigation in Google Chrome on iOS prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to spoof the address bar via a crafted HTML page.

Missing authorization in Accessibility in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page.

Use after free in ServiceWorker in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page.