CVE Vulnerability Catalog

An issue in libretro RetroArch v1.22.2 allows attackers to force another user into loading attacker-supplied code in their uid, leading to arbitrary code execution.

An issue in Forkyz versionCode 8500000 allows attackers to arbitrarily change another user's storage settings via supplying a crafted URI string.

An issue in the WebView rendering path component of MotionCreative Motion UI versionCode 101 allows attackers to execute arbitrary code via supplying a crafted POST request.

Insecure permissions in mendhak GPSLogger versionCode 137 allow unauthorized attackers to arbitrarily manipulate the app's logging mechanism and log data.

A Server-Side Request Forgery (SSRF) in the url/title/author/coverUrl component of FocusPodcast versionCode 70 allows attackers to scan internal resources via supplying a crafted URL.

Insecure permissions in the CitrineContentProvider component of Citrine v3.1.0 (versionCode 62) allow unauthorized attackers to arbitrarily read another's Nostr event database.

Insecure permissions in ProjectMAXS MAXS Main v0.5.19 (versionCode 19) allow unauthorized attackers to arbitrarily manipulate the app's MAXS command/transport mechanism.

The vulnerability stems from insecure permissions in Code Catcher versionCode 131. Unauthorized attackers can arbitrarily manipulate the app's SMS-code-capture mechanism.

Broken Object Level Authorization in the Users Configuration Endpoint allows Information Disclosure to an authenticated user.

A remote code execution (RCE) vulnerability was identified in the FlexNet Publisher lmadmin web user interface. This vulnerability is addressed in the FlexNet Publisher 2023 R2 (11.19.4.0) release.

Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to elevate privileges over a network.

Heap-based buffer overflow in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.

Heap-based buffer overflow in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.

Incomplete list of disallowed inputs in Microsoft Edge (Chromium-based) allows an unauthorized attacker to bypass a security feature over a network.

Use after free in Microsoft Edge for iOS allows an unauthorized attacker to execute code over a network.

Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclose information over a network.

IBM Langflow OSS versions 1.0.0 through 1.12.8 contain an improper authentication flaw that could allow a remote attacker to bypass security restrictions.

Szafir is vulnerable to Path Traversal in the uploaded filename. A man-in-the-middle attacker who can reroute update requests to their server can prepare an arbitrary XML file that will be saved in a location chosen by the attacker. This issue was fixed in version 2.0 build 708.

Szafir and Szafir Weryfikująca are vulnerable to XML External Entity (XXE) injection. When a user signs or verifies a crafted XML file containing a DOCTYPE with an external DTD reference, the parser processes external entities, allowing an attacker to read arbitrary files from the victim's filesystem. This issue was fixed in Szafir version 2.0 build 708. Szafir Weryfikująca is no longer supported (End of Life) and has not been fixed.

IBM Langflow OSS versions 1.0.0 through 1.12.4 contain a vulnerability due to allocation of resources without limits or throttling. A remote authenticated attacker could exploit this to cause a denial of service.