CVE Vulnerability Catalog

A use after free vulnerability in Views in Google Chrome prior to version 148.0.7778.96 allowed a remote attacker who compromised the renderer process to bypass site isolation via a crafted HTML page.

A use after free vulnerability in Fullscreen in Google Chrome prior to version 148.0.7778.96 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page.

Vvveb before version 1.0.8.2 contains a hard-coded credentials vulnerability in its docker-compose-apache.yaml configuration that allows unauthenticated attackers to access the bundled phpMyAdmin container with pre-configured database credentials.

Vulnerability in Apache::Session::Generate::ModUniqueId versions 1.54 through 1.94 for Perl causes session IDs to be generated based on the UNIQUE_ID environment variable from Apache mod_unique_id. The ID relies on IPv4 address, PID, epoch time, a 16-bit counter, and thread index, with no obfuscation, making it predictable.

A vulnerability has been identified in the Linux kernel that has been resolved. The issue concerns passing flow_id to the set_rps_cpu() function, which may lead to out-of-bounds access and system crashes.

A race condition was found in the Linux kernel's tcp_v6_syn_recv_sock() function. After tcp_v4_syn_recv_sock() returns, the child socket is already visible in the TCP ehash table, but the pinet6 pointer still points to the listener's structures, potentially causing issues.

In the Linux kernel, a vulnerability was found in netconsole where the message passed from the console subsystem is not guaranteed to be null-terminated, leading to out-of-bounds reads. KASAN reported a slab-out-of-bounds error during message processing.

In the Linux kernel, __ioam6_fill_trace_data() on the IPv6 IOAM receive path fails to validate trace->nodelen against trace->type. A crafted packet can set nodelen=0 while setting type bits 0-21, causing a write of about 100 bytes past the allocated region (into skb_shared_info), corrupting adjacent heap memory and leading to a kernel panic.

The ksmbd module in the Linux kernel has a signedness bug in smb_direct_prepare_negotiation(). An unsigned __u32 value from preferred_send_size is cast to a signed int before computing min_t(int, ...), so a malicious value of 0x80000000 is treated as smaller than max_recv_size and used to set the maximum allowed receive size. By sending a second message with a large value (>1420 bytes), the attacker can achieve a heap buffer overflow.

In the Linux kernel, the dlm_search_rsb_tree function lacks validation of the len parameter from network messages. When exceeding DLM_RESNAME_MAXLEN, it can cause an out-of-bounds write.

W jądrze Linuxa rozwiązano podatność związaną z systemem plików btrfs, która występowała w funkcji btrfs_sync_file(). Użycie overlay na btrfs prowadziło do błędnego przypisania superbloku, co mogło skutkować awarią systemu.

In the Linux kernel, the AVX2 implementation for pipapo sets in netfilter has a bug that returns non-matching entries on expiry. The issue occurs when AVX2 match functions process the last field without consuming the entire input, leading to false element collision reports.

W jądrze systemu Linux zidentyfikowano podatność, która prowadzi do dostępu poza granice tablicy dev->_tx[], gdy trace->type.bit6 jest ustawione, a is_input jest prawdziwe. Problem ten występuje, gdy urządzenie wejściowe ma więcej kolejek RX niż urządzenie wyjściowe TX.

Missing invocation of the session ID change method after session binding in Apache Wicket can be exploited for a session fixation attack.

Heap-based buffer overflow vulnerability in the mod_proxy_ajp module of Apache HTTP Server. If mod_proxy_ajp connects to a malicious AJP server, that server can send a crafted AJP message causing a write of 4 attacker-controlled bytes beyond the end of a heap buffer.

CoreDNS versions prior to 1.14.3 incorrectly handle TSIG authentication in gRPC, QUIC, DoH, and DoH3 transports. For gRPC and QUIC, the server only checks the TSIG key name but does not validate the HMAC, so any request with a matching key name is considered authenticated. For DoH and DoH3, the issue is more severe – the server never inspects the TSIG record at all, so any request with TSIG is treated as authenticated.

Masa CMS versions 7.2.0-7.2.9, 7.3.0-7.3.14, 7.4.0-7.4.9, and 7.5.0-7.5.2 have an SQL injection vulnerability in the unauthenticated JSON API. The altTable parameter is injected directly into the SQL FROM clause, allowing an unauthenticated attacker to read sensitive data from any table.

Masa CMS is an open source content management system. In versions 7.2.0 through 7.2.9, 7.3.0 through 7.3.14, 7.4.0 through 7.4.9, and 7.5.0 through 7.5.2, a SQL injection vulnerability exists in the beanFeed.cfc component within the getQuery function's handling of the sortDirection parameter. The parameter value is concatenated directly into SQL queries without sanitization or parameterization. An unauthenticated remote attacker can exploit this to extract sensitive information, modify or delete database records, or potentially achieve remote code execution on the underlying database server.

Masa CMS is an open source content management system. In versions 7.5.2 and earlier, a SQL injection vulnerability exists in the beanFeed.cfc component within the getQuery function's processing of the sortBy parameter. The application fails to properly sanitize or parameterize this input before incorporating it into dynamic SQL statements. An unauthenticated remote attacker can execute arbitrary SQL commands against the database, potentially gaining access to sensitive data, modifying or deleting records, or escalating privileges to administrative control. This issue has been fixed in versions 7.2.10, 7.3.15, 7.4.10, and 7.5.3. As a workaround, configure WAF rules to block malicious SQL patterns in the sortBy parameter sent to beanFeed.cfc.