CVE Vulnerability Catalog

In MISP up to version 2.5.38, the ShadowAttribute proposal creation workflow accepted the 'id' field from the client, allowing authenticated users to update existing attributes instead of creating new proposals. This can lead to unauthorized data modification.

Google Chrome prior to version 148.0.7778.179 has insufficient validation of untrusted input in the Input component. A remote attacker who compromised the renderer process can leak cross-origin data via a crafted HTML page.

In Google Chrome on Mac prior to 148.0.7778.179, an out-of-bounds read in GPU allows a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium).

Insufficient policy enforcement in ServiceWorker in Google Chrome prior to 148.0.7778.179 allowed a remote attacker to leak cross-origin data via a crafted HTML page. The vulnerability has a Chromium security severity of High.

Insufficient policy enforcement in Service Worker in Google Chrome prior to 148.0.7778.179 allowed a remote attacker to bypass same origin policy via a crafted HTML page. (Chromium security severity: High)

Out of bounds read in GPU in Google Chrome on Mac prior to 148.0.7778.179 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. (Chromium security severity: High)

Google Chrome on Windows prior to version 148.0.7778.179 has an inappropriate UI implementation allowing a remote attacker to perform UI spoofing via a crafted HTML page.

TeleJSON prior to 6.0.0 contains a DOM-based XSS vulnerability in the parse() function. Attackers can deliver a crafted JSON with a malicious _constructor-name_ value, passed unsanitized to new Function(), enabling arbitrary JavaScript execution, e.g., via postMessage in cross-frame contexts.

Trilium Notes version 0.102.1 and prior contain a critical vulnerability allowing unauthenticated remote code execution (RCE). Lack of SVG sanitization combined with a disabled Content Security Policy (CSP) and a publicly reachable backend execution API allows an attacker to execute arbitrary Node.js code on the server by tricking an authenticated user into viewing a malicious SVG attachment.

Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in search.php that allows authenticated attackers to inject arbitrary JavaScript by passing an unsanitized value through the frm_query POST parameter directly into an HTML input field VALUE attribute. Attackers can craft a malicious request containing a JavaScript payload in the frm_query parameter that executes in the victim's browser when submitted.

Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in do_unit_mail.php that allows authenticated attackers to inject arbitrary JavaScript by passing an unsanitized value through the the_ticket GET parameter directly into a JavaScript variable assignment. Attackers can craft a malicious URL containing a JavaScript payload in the the_ticket parameter that executes in the victim's browser when the URL is visited.

Open ISES Tickets before version 3.44.2 contains a reflected XSS vulnerability in routes_nm.php, where the ticket_id parameter is passed unsanitized into the VALUE attribute of a hidden input field. An authenticated attacker can inject JavaScript via a crafted URL.

Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in street_view.php that allows authenticated attackers to inject arbitrary JavaScript by passing unsanitized values through the thelat and thelng GET parameters directly into JavaScript variable assignments. Attackers can craft a malicious URL containing a JavaScript payload in either parameter that executes in the victim's browser when the URL is visited.

Open ISES Tickets before version 3.44.2 contains a reflected XSS vulnerability in add_facnote.php. An authenticated attacker can inject arbitrary JavaScript via an unsanitized ticket_id GET parameter that is directly placed into the VALUE attribute of a hidden input field.

Open ISES Tickets before version 3.44.2 contains a reflected XSS vulnerability in opena.php. An authenticated attacker can inject arbitrary JavaScript via an unsanitized frm_call GET parameter that is directly output on the page.

Open ISES Tickets before version 3.44.2 contains a reflected XSS vulnerability in patient_JF.php. An authenticated attacker can inject arbitrary JavaScript via an unsanitized ticket_id GET parameter that is directly placed into a JavaScript variable assignment.

Open ISES Tickets before version 3.44.2 contains a reflected XSS vulnerability in add_note.php. An authenticated attacker can inject arbitrary JavaScript via an unsanitized ticket_id GET parameter that is directly placed into the VALUE attribute of a hidden input field.

Open ISES Tickets before version 3.44.2 contains a reflected XSS vulnerability in single.php. An authenticated attacker can inject arbitrary JavaScript via an unsanitized ticket_id GET parameter that is directly placed into an HTML attribute.

Open ISES Tickets before version 3.44.2 contains a reflected XSS vulnerability in single_unit.php. An authenticated attacker can inject arbitrary JavaScript via an unsanitized id GET parameter that is directly placed into an HTML attribute.

ArcGIS Server has an input validation weakness in the login redirection workflow. An authenticated attacker can send a crafted request, causing the browser to redirect to an untrusted site, resulting in limited confidentiality impact under specific user interaction. The vulnerability affects ArcGIS Server 11.5.