CVE Vulnerability Catalog

Aplikacje desktopowe Mattermost w wersjach <=6.1, 6.0.1 oraz 5.4.13.0 nie zapobiegają zamykaniu widoku aplikacji przez treści renderowane przez serwer. Umożliwia to złośliwemu serwerowi lub wtyczce zainicjowanie {{window.close()}} w kontekście renderera, co prowadzi do awarii klienta desktopowego.

Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13 fail to check if {{team_id}} was being changed when updating playbooks, allowing users with only {{Manage Playbook Configurations}} permission to change a playbook's team, bypassing manage members restriction via PUT api.

Wersje Mattermost 11.5.x do 11.5.1 oraz 10.11.x do 10.11.13 nie egzekwują powiązania tożsamości klienta podczas procesu wymiany kodu autoryzacyjnego OAuth. To pozwala uwierzytelnionemu klientowi OAuth na wymianę kodów autoryzacyjnych wydanych dla innego klienta za pomocą spreparowanego żądania wymiany tokenów.

Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13 fail to validate that the RefreshedToken differs from the original invite token during remote cluster invite confirmation, which allows an authenticated attacker to bypass token rotation and reuse the original invite token via sending a crafted invite confirmation with a RefreshedToken matching the original token.

Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13 fail to escape some variables that could contain malicious content during error page composition, which allows an attacker with access to edit some site configuration to execute malicious code via injecting JS as part of those values.

A vulnerability was identified in continuedev continue up to 1.2.22 in the function lsTool of the file core/tools/implementations/lsTool.ts of the JSON-RPC Server component. Manipulation of the dirPath argument leads to path traversal. The attack requires local access, and the exploit is publicly available.

Stack overflow vulnerability in the media platform. Successful exploitation of this vulnerability may affect availability.

A permission control vulnerability exists in the app management and control module. Successful exploitation of this vulnerability may affect service confidentiality.

A race condition in the MxGPU-Virtualization driver’s ioctl path caused by concurrent unsynchronized access to the global variable amdgv_cmd in an unlocked ioctl handler could be exploited to trigger a heap-based buffer overflow.

An out-of-bounds read in the remote management firmware could allow a privileged attacker to read a limited section of memory outside of established bounds, potentially resulting in loss of confidentiality or availability.

Insufficient parameter sanitization in the TEE SOC Driver could allow an attacker to issue a malformed DRV_SOC_CMD_ID_SRIOV_COPY_VF_CHIPLET_REGS command to write invalid data to a remote Die, potentially resulting in unexpected behavior.

The MCP Registry provides MCP clients with a list of MCP servers, like an app store for MCP servers. Prior to 1.7.9, OCI ownership validation skips label-match check when upstream OCI registry returns HTTP 429, letting any authenticated publisher bind their io.github.<user>/* namespace to OCI images they do not control. internal/validators/registries/oci.go:104-119 fails open on http.StatusTooManyRequests: when the registry's anonymous fetch to the upstream OCI registry is rate-limited, ValidateOCI returns nil and the publish is accepted without ever running the io.modelcontextprotocol.server.name label-match check at lines 122-141.

Insufficient validation of untrusted input in Skia in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to perform an out of bounds memory write via a crafted print file.

Out of bounds read in GPU in Google Chrome on Linux prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page.

Insufficient policy enforcement in the Network component of Google Chrome on Android before 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page (Chromium severity: Medium).

Inappropriate implementation in ANGLE in Google Chrome on Windows prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page.

Type Confusion in ANGLE in Google Chrome on Windows prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to perform an out of bounds memory write via a crafted HTML page.

Use after free in GPU in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to perform an out of bounds memory write via a crafted HTML page.

Object corruption in Compositing in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page.

Insufficient validation of untrusted input in ReadingMode in Google Chrome on Mac prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page.