CVE Vulnerability Catalog

Inappropriate implementation in Autofill in Google Chrome prior to 142.0.7444.59. A remote attacker who convinced a user to engage in specific UI gestures could obtain potentially sensitive information from process memory.

Inappropriate implementation in App-Bound Encryption in Google Chrome on Windows prior to 142.0.7444.59 allowed a local attacker to obtain potentially sensitive information from process memory via a malicious file. (Chromium security severity: Medium)

Policy bypass in Extensions in Google Chrome prior to 142.0.7444.59 allowed an attacker who convinced a user to install a malicious extension to obtain potentially sensitive information from process memory via a crafted Chrome Extension.

Incorrect security UI in Omnibox in Google Chrome on Android prior to 142.0.7444.59 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)

A race condition in Storage in Google Chrome on Windows prior to 142.0.7444.59 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page.

Inappropriate implementation in V8 in Google Chrome prior to 142.0.7444.59 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High)

Inappropriate implementation in Extensions in Google Chrome prior to 142.0.7444.59. An attacker who convinced a user to install a malicious extension could bypass navigation restrictions via a crafted Chrome Extension.

Dell PowerScale OneFS, versions prior to 9.10.1.3 and versions 9.11.0.0 through 9.12.0.0, contains a use of a broken or risky cryptographic algorithm vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure.

The Qualys Cloud Agent included a bundled uninstall script (qagent_uninstall.sh) for supported Mac and Linux versions that invoked multiple system commands without using absolute paths and without sanitizing the $PATH environment. If executed with elevated privileges (e.g., via sudo) in an environment with a manipulated $PATH, an attacker with root/sudo privileges could cause malicious executables to run instead of intended system binaries. This can be leveraged for local privilege escalation and arbitrary command execution under elevated privileges.

In JetBrains ReSharper, Rider and dotTrace before 2025.2.5 local privilege escalation was possible via race condition.

A SQL injection vulnerability has been discovered in SourceCodester Interview Management System up to version 1.0, specifically in the file /addCandidate.php. Manipulation of the candName argument results in SQL injection. The attack can be launched remotely. The exploit has been released publicly and may be exploited.

SOPlanning v1.53.02 contains a stored Cross-Site Scripting (XSS) vulnerability due to lack of proper validation of user input. An attacker can send a specially crafted POST request using the 'LOGOUT_REDIRECT' parameter in '/soplanning/www/process/options.php' to execute a malicious script.

Smart School 7.0 has a Stored Cross-Site Scripting (XSS) vulnerability due to lack of proper validation of user input when sending a POST request to '/online_admission', affecting parameters 'firstname', 'lastname', 'guardian_name' and others. This could allow a remote user to send a specially crafted query to an authenticated user and steal their session cookie details.

A SQL injection vulnerability has been identified in SourceCodester Baby Care System 1.0, specifically in the file /updatewelcome.php?id=siteoptions&action=welcome. Manipulation of the roleid argument leads to SQL injection. The attack can be launched remotely. The exploit is publicly available and might be used.

A SQL Injection vulnerability was determined in SourceCodester Baby Care System 1.0 in /admin.php?id=inbox via manipulation of the msgid argument. The attack can be initiated remotely and a public exploit is available.

A SQL injection vulnerability has been found in SourceCodester Food Ordering System 1.0, specifically in the file /routers/edit-orders.php. Manipulation of the ID argument results in SQL injection. The attack can be launched remotely. The exploit has been made public and could be used.

A SQL injection vulnerability has been found in SourceCodester Food Ordering System 1.0, specifically in the file /view-ticket.php. Manipulation of the ID argument leads to SQL injection. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used.

A SQL injection vulnerability was detected in DedeBIZ up to 6.3.2 in an unknown function of /admin/archives_add.php. Manipulation of the flags[] argument leads to SQL injection. The attack can be executed remotely and the exploit has been publicly disclosed.

A SQL injection vulnerability has been identified in SourceCodester Farm Management System 1.0 in the /review.php file via manipulation of the pid argument. The attack can be performed remotely, and the exploit has been publicly disclosed.

A missing authorization vulnerability was identified in rymcu forest in the GlobalResult function of src/main/java/com/rymcu/forest/web/api/bank/BankController.java. The attack can be initiated remotely. The product uses a rolling release model, so no specific version information is available.