CVE Vulnerability Catalog

Insufficient policy enforcement in ViewTransitions in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to leak cross-origin data via a crafted HTML page.

Out of bounds read in Media in Google Chrome on Linux and ChromeOS prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to obtain potentially sensitive information from process memory via a crafted JPEG file.

Insufficient validation of untrusted input in the SiteIsolation component of Google Chrome prior to 148.0.7778.168. A remote attacker who had compromised the renderer process could bypass Site Isolation via a crafted HTML page.

Insufficient validation of untrusted input in DataTransfer in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who convinced a user to engage in specific UI gestures to obtain potentially sensitive information from process memory via a crafted HTML page. Chromium severity: Critical.

OpenImageIO before 3.0.18.0 and 3.1.13.0 has a 32-bit unsigned integer overflow in the bounds check of TGAInput::decode_pixel. With k = 0xFFFFFFFC and palbytespp = 4, the addition wraps to 0 and passes the check, after which the palette access uses the unwrapped index and reads about 4 GB past the palette buffer, causing a SEGV.

Fleet prior to 4.81.0 contains a denial-of-service (DoS) issue in the gRPC Launcher PublishLogs endpoint. Certain unexpected input values were not handled gracefully, which could cause the Fleet server process to terminate while processing an authenticated request. An authenticated attacker with access to any enrolled Launcher node key could cause an immediate and complete denial of service with a single gRPC request. Version 4.81.0 contains the patch.

Fleet prior to 4.80.1 trusted client-supplied IP address headers when determining the source IP for incoming requests. Authenticated and unauthenticated clients could spoof their apparent IP address and bypass per-IP rate limiting controls. Version 4.80.1 contains the patch.

Foscam VD1 Video Doorbell before V5.3.13_1072 transmits sensitive Session Description Protocol (SDP) data, including ICE credentials and candidates, in cleartext over network interfaces.

In Strapi versions prior to 5.33.3, the Upload plugin's Content API endpoints did not enforce administrator-configured MIME type restrictions. An authenticated user with Content API upload permission could upload disallowed file types, including HTML and SVG, potentially leading to admin session hijack in default deployments.

In Strapi prior to 5.33.3, changing or resetting a user's password did not invalidate existing refresh-token sessions by default, because the invalidation step depended on a caller-supplied deviceId. An attacker with a previously obtained refresh token could continue minting new access tokens after the legitimate user reset their password, maintaining unauthorized access for up to 30 days. The patch in 5.33.3 invalidates all refresh tokens on every password change and reset.

In Strapi versions prior to 5.45.0, the rate-limit middleware in the users-permissions plugin derived its rate-limit key in part from `ctx.request.body.email`, including on routes whose body schema does not contain an email field (e.g. /auth/local, /auth/reset-password, /auth/change-password). An unauthenticated attacker could include an arbitrary email value in the request body to obtain a fresh rate-limit key per request, effectively bypassing per-IP throttling and enabling high-volume credential brute-force, password-reset code brute-force, and credential-stuffing attempts.

Vulnerability in GStreamer gst-plugins-good before 1.28.2. When parsing MP4 audio tracks, the isomp4 plugin's qtdemux_audio_caps function does not sufficiently validate atom data before performing division operations, leading to denial of service due to integer division by zero.

An issue was discovered in GStreamer gst-plugins-good before 1.28.2. When parsing MP4 audio tracks, the isomp4 plugin's qtdemux_parse_trak function does not sufficiently validate atom data before performing division operations, leading to denial of service due to integer division by zero.

Prior to 1.5.1, Docling-Graph's URLInputHandler makes HTTP requests to user-supplied URLs without validating whether the target resolves to a private, loopback, or link-local IP address, and allows redirects, enabling Server-Side Request Forgery via the --source CLI argument or PipelineConfig.source API parameter.

In Pode, a cross-platform PowerShell web framework for creating REST APIs, web sites, and TCP/SMTP servers, from 2.4.0 to before 2.13.0, when requesting content from a Static Route, it was possible to request paths such as http://localhost:8080/c:/Windows/System32/drivers/etc/hosts and have the contents returned.

In Distribution (a toolkit to pack, ship, store, and deliver container content) prior to 3.1.1, tag deletion via the DELETE /v2/<name>/manifests/<tag> endpoint bypasses the storage.delete.enabled: false configuration, allowing any API client to remove tags from repositories even when the operator has explicitly disabled deletion. This vulnerability is fixed in 3.1.1.

An open redirect vulnerability (CWE-601) that redirects users to an untrusted site. Technical details were not provided in the description.

Kubetail before 0.14.0 exposes WebSocket endpoints that do not adequately validate the Origin header on connection upgrade. A malicious web page visited by a user with an active Kubetail session could open a WebSocket to the dashboard and read Kubernetes logs in real time (Cross-Site WebSocket Hijacking).

css_parser is a Ruby CSS parser. Prior to 2.1.0 and 1.22.0, the CSS Parser gem does not validate HTTPS connections, allowing a Man-in-the-Middle (MITM) attacker to inject or modify CSS content when stylesheets are loaded via HTTPS. The connection is established with OpenSSL::SSL::VERIFY_NONE, meaning any HTTPS certificate—even entirely untrusted—will be accepted without validation.

A vulnerability in the web UI of Cisco Catalyst SD-WAN Manager (formerly SD-WAN vManage) allows an authenticated, remote attacker with read-only permissions to modify configurations and perform unauthorized actions. The issue is due to a failure to redact sensitive information within device configurations and templates.