CVE Vulnerability Catalog

Uninitialized resource in GPU in Google Chrome on Android prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

Uninitialized resource in GPU in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Severity: High)

Incorrect authorization in MediaCapture in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to obtain cross-origin data via a crafted Chrome extension. (Severity: Medium)

Unchecked return value in Performance in Google Chrome prior to 154.0.8037.57 allowed a local attacker to potentially read memory via a local program. (Severity: Low)

Information leak in Passwords in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to obtain cross-origin data via a crafted HTML page. (Severity: Medium)

Integer overflow in Metrics in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to potentially read memory outside the sandbox via a crafted HTML page. (Severity: Low)

Incorrect authorization in WebAPKs in Google Chrome on Android prior to 154.0.8037.57 allowed a local attacker to obtain cross-origin data via a co-installed app. (Severity: Medium)

Joomla! Core has improper ACL checks for workflow stage changes. Unauthorized users can update the workflow stage of inaccessible contents. Affects versions 5.0.0-5.4.8 and 6.0.0-6.1.3.

Joomla! Core has improper ACL checks in the content history comparison view. Unauthorized users can view inaccessible contents. Affects versions 4.0.0-5.4.8 and 6.0.0-6.1.3.

ImageMagick versions before 7.1.2-32 and 6.9.13-57 contain uninitialized heap memory disclosure in the GIF decoder's application extension handler in coders/gif.c. Attackers can craft malicious GIF files that cause the number parser to read uninitialized heap memory and store contents as image metadata, disclosing sensitive heap information.

Serialize JavaScript from version 7.1.1 until 7.1.2 does not fully protect serialized functions against script-closing tags in attacker-influenced function source. This can cause the script element to terminate early and the remaining output to be parsed as HTML, enabling cross-site scripting in the page origin. Only function values are affected, and the issue is fixed in version 7.1.2.

SM2 signature generation uses non-constant-time arithmetic on secret values, forming a timing side-channel. An attacker able to measure SM2 signing times may learn information about the per-signature secret nonce, which over many signatures can lead to recovery of the private key. Applications performing SM2 signature generation are affected on all platforms.

OpenSSL's optimized scalar point multiplication implementation for SM2 private key operations on ARM64 and RISC-V platforms is not constant-time. Conditional branches and table lookups depend on the bits of the secret scalar, so execution time and cache-access patterns leak information about the private key or signature nonce.

The generic elliptic-curve scalar multiplication used for ECDSA and SM2 signature operations with curves lacking a dedicated implementation leaks information about the secret nonce through timing. An attacker measuring signing times may learn the nonce, which over many signatures can lead to private key recovery.

The OpenSSL QUIC server, when address validation is disabled, can count incoming datagrams multiple times in its unvalidated credit computation. This violates the RFC 9000 3x amplification limit, allowing a remote attacker to use the server for DDoS amplification.

Flysystem prior to 3.35.3 has a vulnerability in the default WhitespacePathNormalizer that calls preg_match with the u modifier and treats both false and 0 as falsy. A path containing malformed UTF-8 causes PCRE to return false, allowing paths with control characters to bypass validation. This can lead to hidden or spoofed terminal file listings when an administrator displays them.

OAuth credentials (access tokens) are valid for the entirety of their lifetime, even if the application (OAuth client) they are bound to is manually disabled.

Malicious HTML content could be injected into the help texts of various fields with organizer permissions.

The mechanism binding API-uploaded files to the uploader's authentication method is not working correctly and the same session token is used for all token-based API users. Since API-uploaded files are referred to by randomly generated UUIDs and only exist for a day, there is virtually no risk, but it renders the added protection mechanism useless.

If an attacker is able to convince a victim to click a specially crafted link, the victim is logged in to the attacker's customer account. If the victim does not notice this, it might lead to their order details being stored into the attacker's account. The attack only works when the event is available on a different domain than the organizer page.