CVE Vulnerability Catalog

Inappropriate implementation in Lens in Google Chrome on iOS prior to 136.0.7103.59 allowed a remote attacker to perform UI spoofing via a crafted QR code. (Chromium security severity: Low)

Inappropriate implementation in Fullscreen in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)

Inappropriate implementation in Dawn in Google Chrome on Mac prior to 130.0.6723.92 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High)

Inappropriate implementation in Intents in Google Chrome on Android prior to 129.0.6668.58 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)

grist-core is a spreadsheet hosting server. Prior to version 1.7.7, a user with only partial read access to a document could still access endpoints listing hashes for versions of that document and receive a full list of changes between versions, even if those changes contained cells, columns, or tables to which the user was not supposed to have read access. This was fixed in version 1.7.7 by restricting the /compare endpoint to users with full read access. As a workaround, remove sensitive document history using the /states/remove endpoint. Another possibility is to block the /compare endpoint.

In grist-core prior to version 1.7.7, a user with access to any document can use a server-side URL fetching feature. The privileged network access of server-side requests could enable attack escalation.

Directus REST API versions prior to 11.13.0 exhibit an observable difference in error messages: the /items/{collection} endpoint returns different errors when a user tries to access an existing collection they are not authorized for versus a non-existing collection. This difference leaks the existence of collections to unauthorized users. Version 11.13.0 fixes the issue.

Directus is a real-time API and App dashboard for managing SQL database content. A vulnerability in versions prior to 11.13.0 allows authenticated users to search concealed/sensitive fields when they have read permissions. While actual values remain masked (****), successful matches can be detected through returned records, enabling enumeration attacks on sensitive data.

Directus versions prior to 11.13.0 contain a stored cross-site scripting (XSS) vulnerability. Users with upload files and edit item permissions can inject malicious JavaScript through the Block Editor interface, bypassing Content Security Policy (CSP) by combining file uploads with iframe srcdoc attributes. The issue is fixed in version 11.13.0.

Directus before version 11.13.0 does not properly clean up field-level permissions when a field is deleted. Stale permission entries remain, and a new field with the same name inherits outdated permissions.

A denial-of-service (DoS) vulnerability in Palo Alto Networks PAN-OS software allows an unauthenticated attacker to reboot a firewall by sending a specially crafted packet through the dataplane. Repeated reboot attempts cause the firewall to enter maintenance mode.

A class name enumeration was found in Keyfactor SignServer versions prior to 7.3.2. Setting any chosen class name to properties requiring a class path causes different errors depending on whether the class exists in the deployment, returning information about loaded classes to the client side.

An arbitrary file write vulnerability was found in Keyfactor SignServer versions prior to 7.3.2. The ARCHIVETODISK_FILENAME-PATTERN, ARCHIVETODISK_PATH_BASE, and ARCHIVETODISK_PATH_PATTERN properties can be set to any path, including existing files, allowing an admin user to write files in arbitrary directories and potentially overwrite files accessible by the JBoss user.

A local file enumeration was found in Keyfactor SignServer versions prior to 7.3.2. The VISIBLE_SIGNATURE_CUSTOM_IMAGE_PATH property in PDFSigner and PAdESSigner can be set by an admin to any path without restrictions; if it points to an existing file readable by the application server user but not a recognized image format, an error is returned to the client confirming the file's existence.

A command injection vulnerability exists in the TOTOLINK A950RG router firmware V5.9c.4592_B20191022_ALL within the system.so binary. The setDiagnosisCfg function retrieves the ipDoamin parameter from user input and concatenates it directly into a ping command without sanitization, allowing an unauthenticated remote attacker to execute arbitrary commands.

A buffer overflow vulnerability exists in the TOTOLINK A950RG router firmware V5.9c.4592_B20191022_ALL within the global.so binary. The getSaveConfig function retrieves the http_host parameter and copies it into a fixed-size stack buffer using strcpy() without length checks, potentially leading to arbitrary code execution by an unauthenticated remote attacker.

A vulnerability was found in the Alaga Home Security WiFi Camera 3K (model S-CW2503C-H) with hardware version V03 and firmware version 1.4.2, which allows physical attackers to execute commands as root via a script file with a specific name on an SD card.

Dell Alienware Command Center 6.x (AWCC) versions prior to 6.10.15.0 contain an Insecure Temporary File vulnerability. A low-privileged attacker with local access could exploit this vulnerability, leading to information tampering.

Dell Alienware Command Center 6.x (AWCC), versions prior to 6.10.15.0, contain an Improper Access Control vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information Tampering.

A command injection vulnerability exists in the D-Link DIR-823G router firmware DIR823G_V1.0.2B05_20181207.bin in the timelycheck and sysconf binaries. The vulnerability occurs because parsed fields from the /tmp/new_qos.rule configuration file are concatenated into command strings and executed via system() without any sanitization.