CVE Vulnerability Catalog

Insufficient validation of untrusted input in Downloads in Google Chrome on Android prior to 140.0.7339.80 allowed a remote attacker to perform domain spoofing via a crafted HTML page.

Inappropriate implementation in Permissions in Google Chrome prior to 140.0.7339.80 allowed a remote attacker to perform UI spoofing via a crafted HTML page.

Inappropriate implementation in Downloads in Google Chrome on Windows prior to 140.0.7339.80 allowed a remote attacker to bypass Mark of the Web via a crafted HTML page.

Potential Denial of Service issue in all supported versions of Revenera InstallShield version 2025 R1, 2024 R2, 2023 R2, and prior. When e.g., a local administrator performs an uninstall, a symlink may get followed on removal of a user writeable configuration directory and induce a Denial of Service as a result. The issue is resolved through the hotfixes InstallShield2025R1-CVE-2025-12418-SecurityPatch, InstallShield2024R2-CVE-2025-12418-SecurityPatch, and InstallShield2023R2-CVE-2025-12418-SecurityPatch.

Improper resource management in the firmware of some Solidigm DC products may allow an attacker with local or physical access to gain unauthorized access to a locked storage device or cause a denial of service.

Improper resource management in firmware of some Solidigm DC Products may allow an attacker with local or physical access to gain unauthorized access to a locked storage device.

A weakness has been identified in mruby 3.4.0 affecting the ary_fill_exec function in mrbgems/mruby-array-ext/src/array.c. Manipulating the start/length arguments can lead to an out-of-bounds write. The attack requires local access, the exploit is publicly available, and the fix is commit 93619f06dd378db6766666b30c08978311c7ec94.

A flaw was found in FFmpeg's ALS audio decoder where it does not properly check for memory allocation failures. This can cause the application to crash when processing certain malformed audio files.

IBM Db2 versions 12.1.0 through 12.1.2 for Linux, UNIX, and Windows (including Db2 Connect Server) could allow a local user to cause a denial of service due to improper neutralization of special elements in data query logic.

IBM Db2 11.5.0-11.5.9 and 12.1.0-12.1.3 for Linux, UNIX and Windows (including DB2 Connect Server) can allow a local user to cause a denial of service due to the database monitor script incorrectly detecting that the instance is still starting under specific conditions.

IBM Sterling B2B Integrator and IBM Sterling File Gateway are vulnerable to cross-site scripting. An authenticated user can embed arbitrary JavaScript code in the Web UI, altering intended functionality and potentially leading to credential disclosure within a trusted session.

The clpplus command in IBM Db2 for Linux, UNIX, and Windows exposes user credentials to the terminal, which could be obtained by a third party with physical access to the system.

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.3 for Linux, UNIX and Windows (includes Db2 Connect Server) could allow an authenticated user to cause a denial of service due to improper allocation of resources.

IBM Db2 10.5.0 through 10.5.11, 11.1.0 through 11.1.4.7, 11.5.0 through 11.5.9, and 12.1.0 through 12.1.3 for Linux, UNIX and Windows (includes Db2 Connect Server) could allow an authenticated user to cause a denial due to the improper release of resources after use.

IBM Db2 versions 10.5.0 through 10.5.11, 11.1.0 through 11.1.4.7, 11.5.0 through 11.5.9, and 12.1.0 through 12.1.3 for Linux could allow an authenticated user to regain access after account lockout due to password use after expiration date. This means the account lockout mechanism does not properly enforce password expiration.

IBM Db2 versions 11.1.0 through 11.1.4.7, 11.5.0 through 11.5.9, and 12.1.0 through 12.1.3 for Linux, UNIX and Windows (including Db2 Connect Server) is vulnerable to a denial of service as the server may crash under certain conditions with a specially crafted query.

Improper handling of malformed Connection Request with the interval set to 1 (which is supposed to be illegal) and chM 0x7CFFFFFFFF triggers a crash. The peripheral will not be connectable after it.

IBM Db2 for Linux, UNIX, and Windows (including Db2 Connect Server) is vulnerable to a denial of service as the server may crash under certain conditions with a specially crafted query.

A SQL injection vulnerability exists in SourceCodester PQMS (Patient Queue Management System) 1.0 in the api_patient_schedule.php endpoint. The appointmentID parameter is not properly sanitized, allowing attackers to execute arbitrary SQL commands.

The SourceCodester Leads Manager Tool v1.0 is vulnerable to Cross-Site Request Forgery (CSRF) attacks that allow unauthorized state-changing operations. The application lacks CSRF protection mechanisms such as anti-CSRF tokens or same-origin verification for critical endpoints.