CVE Vulnerability Catalog

Type confusion in V8 in Google Chrome prior to 153.0.8010.52. A remote attacker using social engineering could execute arbitrary code inside the sandbox via a crafted HTML page. (Severity: High)

Incorrect reference resolution in Tracing in Google Chrome on Windows prior to 153.0.8010.52. A local attacker could potentially execute arbitrary code outside the sandbox via a local program. (Severity: High)

Jupyter Server, the backend for Jupyter web applications, prior to version 2.21.0 copies the Referer header into a JSON header block in the 5xx request logging path without applying the token scrubbing used for the request URI. A request returning HTTP 500 whose Referer contains a token-bearing URL can write that token to server logs in plaintext.

Paella Player is a set of libraries to create a multi stream video player. Prior to Paella Player 2.12.11 (as used in Opencast prior to 19.7 and 20.2), there is a potential XSS attack through closed captions cue text. This vulnerability is fixed in 2.12.11.

A stored cross-site scripting vulnerability exists in the Geomap panel's MapLibre base layer. A user with the Editor role can execute arbitrary JavaScript in another user's session by hosting a malicious style configuration, enabling escalation to Org Admin.

fulgur, a tool converting untrusted HTML/CSS to PDF, prior to version 0.19.0 sliced a body-direct child whose CSS-resolved height greatly exceeds the page height into one fragment per page with no upper bound. This can lead to excessive resource consumption or process hang.

fulgur, a tool converting untrusted HTML/CSS to PDF, prior to version 0.19.0 sliced a body-direct child whose CSS-resolved height greatly exceeds the page height into one fragment per page with no upper bound. This can lead to excessive resource consumption or process hang.

NetBox Device Type Library, a collection of community-sourced device type definitions for import into NetBox, is vulnerable due to the absence of tests/init.py and the lack of --import-mode=importlib, causing pytest prepend import mode to place the tests directory at the front of sys.path during collection. An unauthenticated contributor can add a module such as tests/git.py that shadows GitPython or tests/conftest.py, leading to arbitrary code execution on the GitHub Actions runner.

ITFlow, an IT documentation, ticketing and accounting system for small MSPs, prior to version 26.07 allows an authenticated user with module_support write permission and access to a credential record to perform time-based blind SQL injection through the expires parameter of the share_generate_link handler in agent/ajax.php. The expires parameter is inserted unquoted into the MySQL INTERVAL expression, allowing conditional database queries.

In ITFlow prior to version 26.07, an authenticated Technician or higher with access to at least one client invoice can inject SQL through the frequency parameter handled by agent/post/recurring_invoice.php. The parameter is sanitized but interpolated unquoted into DATE_ADD, allowing SQL syntax to escape the interval expression and expose database data.

In Speakr prior to 0.8.21-alpha, the csrf_exempt_for_api_tokens() hook permanently exempts a view from CSRF protection, and is_token_authenticated() treats any present token (including from URL query) as authenticated without validation. A network attacker can disable CSRF protection and perform cross-origin attacks.

In MapServer prior to 8.6.4, PostGIS filter translation in msPostGISLayerTranslateFilter() treats a filteritem as numeric when CONNECTIONTYPE POSTGIS and Integer metadata are configured, but does not verify that attacker-controlled CGI or OGC API Features input is a numeric literal. The unquoted input is concatenated into the SQL predicate, enabling SQL injection.

In Glean prior to 0.2.6, POST /api/feeds/discover passes an attacker-supplied feed_url to fetch and parse without network-level validation. A malicious feed can make the server request private, loopback, link-local, or cloud-metadata resources, with the response stored and retrievable via API.

The ping diagnostics and other similar functions of the MitraStar GPT-2741GNAC-N2-SV router with firmware BR_g8.10_1.11(WVK.0)b46 allow authenticated users to execute arbitrary OS commands via concatenated params on a crafted POST request for the endpoint /cgi-bin/device-management-utilities-internet.cgi.

In dd-trace-cpp prior to 2.1.0, parsing incoming W3C baggage headers does not enforce DD_TRACE_BAGGAGE_MAX_ITEMS or DD_TRACE_BAGGAGE_MAX_BYTES. A remote unauthenticated attacker can send a header with many key-value pairs or one very large value, causing unbounded CPU and memory consumption.

In Datadog PHP Tracer prior to 1.19.2, ddtrace_deserialize_baggage parses incoming W3C baggage headers without enforcing DD_TRACE_BAGGAGE_MAX_ITEMS or DD_TRACE_BAGGAGE_MAX_BYTES. A remote unauthenticated client can send many key-value pairs or one oversized value, causing unbounded CPU and memory consumption.

In OpenSlide from 3.4.1 until 4.0.1, parse_level0_xml() processes a crafted Ventana BIF file accepting nonpositive row or column tile counts. The invalid counts produce attacker-controlled memory offsets and allow arbitrary writes, resulting in a crash or potential arbitrary code execution.

Grafana OSS and Grafana Enterprise did not safely resolve symbolic links when extracting plugin archives. A crafted archive can chain relative symlinks to escape the plugin installation directory, writing arbitrary files and an executable backend binary outside it, which then runs with Grafana server privileges.

NetworkManager-l2tp through 1.52.4, fixed in 1.52.6, contains an improper input validation vulnerability that allows local users with VPN connection creation permissions to inject arbitrary pppd directives by supplying mru or mtu property values containing trailing non-numeric content after a valid integer. Attackers can exploit the verbatim write of unvalidated strings into the pppd options file via write_config_option() to inject the plugin directive, causing the privileged pppd process to load an attacker-controlled shared object and achieve arbitrary code execution as root.

AWS IoT Device SDK for Python versions 1.5.3 through 1.6.0 on Python 3.7 and later has improper certificate validation with host mismatch in the MQTT client TLS connection layer. An adversary-in-the-middle can impersonate the AWS IoT Core endpoint, read telemetry, and inject arbitrary MQTT messages.