CVE Vulnerability Catalog

Insufficient validation of untrusted input in Persistent Cache in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page (severity: Medium).

Insufficient policy enforcement in DevTools in Google Chrome before 148.0.7778.96 allowed an attacker who convinced a user to install a malicious extension to bypass navigation restrictions via a crafted Chrome Extension (Chromium severity: Medium).

Inappropriate implementation in ServiceWorker in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page.

HCL BigFix Service Management (SM) is susceptible to a Root File System Not Mounted as Read-Only issue. An improperly configured root file system may allow unintended modifications to critical system components.

A vulnerability was detected in FlowiseAI Flowise up to 3.0.12. This affects the function verify of the file packages/server/src/enterprise/services/account.service.ts of the component Endpoint. Performing a manipulation results in information disclosure. Remote exploitation of the attack is possible. The attack is considered to have high complexity. It is indicated that the exploitability is difficult. The exploit is now public and may be used. Upgrading the affected component is recommended.

HCL BigFix Service Management (SM) is affected by a security misconfiguration due to a missing or insecure “X-Content-Type-Options” header. This could allow browsers to perform MIME-type sniffing, potentially causing malicious content to be interpreted and executed incorrectly.

HCL BigFix Service Management (SM) is affected by a security misconfiguration vulnerability due to CSP header. This could allow attackers to inject malicious scripts increasing the risk of cross-site scripting (XSS) and potential exposure of sensitive information.

HCL BigFix Service Management (SM) had directories that were not linked or publicly visible but could be accessed directly. This could allow an increased risk of information disclosure or misuse of sensitive functionality.

HCL BigFix Service Management (SM) is affected by an Information Disclosure – Server Banner issue. Exposed server banners may reveal software versions and system details, potentially aiding attackers in targeting known vulnerabilities.

HCL BigFix Service Management (SM) application fails to strip EXIF metadata from uploaded images. This could lead to confidentiality and privacy risks if sensitive location information is unintentionally shared.

HCL BigFix Service Management (SM) is affected by a Cross-Site Request Forgery (CSRF) vulnerability. This could lead to unauthorized changes or exposure of sensitive data.

A security flaw has been discovered in FlowiseAI Flowise up to 3.0.12. Affected is the function Login of the file packages/server/src/enterprise/services/account.service.ts of the component API Response Handler. The manipulation results in information disclosure. The attack can be launched remotely. A high complexity level is associated with this attack. The exploitability is told to be difficult. You should upgrade the affected component.

HCL BigFix RunBookAI is affected by a Continued availability of Less-Secure 'Input Text' Vulnerability. A component contains a security weakness in its input handling implementation, increasing the risk of misconfiguration and operational errors.

HCL DFXAnalytics is affected by an Insecure Security Header Configuration vulnerability where the application utilizes the outdated X-XSS-Protection header, which could allow an attacker to exploit browser-specific rendering flaws or bypass security controls that should instead be managed by a robust Content Security Policy (CSP).

HCL DFXAnalytics is affected by an Improper Error Handling vulnerability where the application exposes detailed stack traces in responses, which could allow an attacker to gain insights into the application's internal structure, code logic, and environment configurations.

HCL DFXAnalytics is affected by an Insufficient Transport Layer Protection vulnerability where data is transmitted over the network without encryption, which could allow an attacker to compromise the confidentiality, integrity, and authentication of sensitive information.

HCL DFXAnalytics is affected by a Using Components with Known Vulnerabilities flaw where the application utilizes unpatched libraries or sub-components, which could allow an attacker to identify and exploit publicly known security vulnerabilities to gain unauthorized access or compromise the application.

In Paramiko through 4.0.0 before commit a448945, the rsakey.py file allows the SHA-1 algorithm.

A vulnerability in Langchain-Chatchat up to version 0.3.1.3 in the _get_file_id function of the Uploaded File Handler component generates insufficiently random values, potentially allowing an attacker to predict file IDs. The attack requires local network access and is considered difficult.

In Langchain-Chatchat up to version 0.3.1.3, the OpenAI-Compatible File Upload API has a time-of-check time-of-use (TOCTOU) vulnerability when processing the file.filename argument. The exploit is public and the project has not responded.