CVE Vulnerability Catalog

A Use-After-Free vulnerability in the Views component of Google Chrome prior to version 150.0.7871.47 was discovered. A remote attacker, by convincing a user to perform specific UI gestures, could potentially exploit heap corruption via a crafted HTML page.

A use-after-free vulnerability in Chromoting in Google Chrome on ChromeOS prior to 150.0.7871.47 allows a remote attacker to execute arbitrary code via malicious network traffic.

A use-after-free vulnerability in WebUSB in Google Chrome on Mac prior to 150.0.7871.47 allows a local attacker to execute arbitrary code via a malicious peripheral.

Insufficient validation of untrusted input in iOSWeb in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. The issue has a Critical severity rating from Chromium.

A use-after-free vulnerability in Extensions in Google Chrome prior to 150.0.7871.47 allows an attacker who convinces a user to install a malicious extension to execute arbitrary code via a crafted Chrome Extension.

The vulnerability in picklescan before version 0.0.29 fails to detect the built-in profile.Profile.run function when used in pickle reduce methods, allowing attackers to execute arbitrary code. Remote attackers can craft malicious pickle files that bypass picklescan detection and achieve code execution upon deserialization.

A vulnerability in picklescan before version 0.0.29 allows bypassing detection of malicious pickle files by using code.InteractiveInterpreter.runcode in reduce methods. Attackers can craft pickle payloads that execute arbitrary code when loaded via pickle.load().

The vulnerability in picklescan before version 0.0.30 fails to detect the doctest.debug_script function when analyzing pickle files, allowing attackers to execute arbitrary code. Remote attackers can craft malicious pickle files embedding doctest.debug_script calls that bypass picklescan detection and execute arbitrary commands upon pickle.load invocation.

The vulnerability in picklescan before version 0.0.30 fails to detect cProfile.run function calls in pickle reduce methods, allowing attackers to execute arbitrary code. Remote attackers can craft malicious pickle files with cProfile.run payloads that bypass picklescan detection and achieve code execution upon deserialization.

Picklescan before version 0.0.25 fails to detect unsafe global functions in the Numpy library, allowing attackers to bypass static analysis and execute arbitrary code during deserialization. Attackers can craft malicious pickle files using numpy.testing._private.utils.runstring within the reduce method to import dangerous libraries like os and execute arbitrary OS commands when the pickle file is loaded.

A vulnerability in picklescan before version 0.0.29 fails to detect the built-in Python trace.Trace.runctx function when used in pickle file reduce methods, allowing attackers to execute arbitrary code. Remote attackers can craft malicious pickle files with trace.Trace.runctx payloads that bypass picklescan detection and execute code upon pickle.load() invocation.

Picklescan before version 0.0.28 fails to detect malicious pickle files using the torch.utils.collect_env.run function in reduce methods. Attackers can embed undetected code in pickle files that executes remote commands when loaded by victims.

The vulnerability in picklescan before version 0.0.29 fails to detect the built-in trace.Trace.run function when analyzing pickle files. This allows attackers to embed undetected malicious code that can be executed when pickle.load processes the file.

A vulnerability in the MessagePack library for Python allows out-of-bounds read and process crash when reusing an Unpacker object after an error. The issue is fixed in version 1.2.1.

An unauthenticated attacker can read worklist records from a directory outside the intended per-AE worklist storage area. In a multi-area deployment, this can cross departmental or clinic data separation.

A buffer overflow vulnerability has been discovered in the UTT nv518G router running firmware version nv518GV3v3.2.7-210919-161313. A remote attacker can exploit the gohead/sub_416f28 component to cause a denial of service (DoS).

An unauthenticated remote attacker can repeatedly send a single crafted connection request to leak memory. Against storescp in its default single-process mode, memory grows quickly and the service is eventually killed, after which it stops accepting connections until an operator restarts it.

An unauthenticated remote attacker can repeatedly send crafted connection requests to leak memory. In single-process deployments the memory grows until the service is killed and the port stops responding until restart.

IBM WebSphere Application Server 9.0, 8.5 and Liberty 17.0.0.3 through 26.0.0.6 are affected by an HTTP request smuggling vulnerability. This flaw allows an attacker to manipulate HTTP headers to bypass security controls.

An unauthenticated attacker can crash the worklist server with a single crafted query when the server has a valid Called AE Title / storage directory, the expected lockfile, and at least one matching worklist record.