CVE Vulnerability Catalog

Incomplete cleanup in Extensions in Google Chrome prior to 153.0.8010.36. A remote attacker leveraging social engineering could bypass system access restrictions via a crafted Chrome extension.

UI misrepresentation in the Session component of Google Chrome prior to 153.0.8010.36 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Severity: Medium)

Missing authorization in the Actor component of Google Chrome prior to 153.0.8010.36 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Severity: Medium)

Missing authorization in the Downloads component of Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass system access restrictions via a crafted Chrome extension. (Severity: Medium)

Information leak in the ServiceWorker component of Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to obtain sensitive information via a crafted HTML page. (Severity: Medium)

Information leak in the Frames component of Google Chrome prior to 153.0.8010.36 allowed a remote attacker to leak sensitive information via a crafted HTML page. (Severity: Low)

Incomplete cleanup in the Browser component of Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted Chrome extension. (Severity: Medium)

Information leak vulnerability in the ControlledFrame component in Google Chrome prior to 153.0.8010.36. A remote attacker who compromised the renderer process could obtain sensitive information via a crafted HTML page.

Incorrect authorization in Navigation in Google Chrome prior to 153.0.8010.36. A remote attacker who compromised the renderer process could spoof UI elements via a crafted HTML page.

Missing authorization in ServiceWorker in Google Chrome prior to 153.0.8010.36. A remote attacker who compromised the renderer process could bypass system access restrictions via a crafted HTML page.

MCP Kotlin SDK versions 0.7.0 through 0.12.0 have an unbounded buffer growth in the ReadBuffer.append function, allowing a remote attacker to exhaust memory (OOM) and crash the process. The issue occurs in the stdio transport where data is buffered without a size limit.

Sylius, an open-source eCommerce framework on Symfony, contains a vulnerability in versions from 2.0.0 to 2.0.17, 2.1.14, and 2.2.5. The GET and PUT API endpoints for payment requests do not verify resource ownership based on the hash, allowing an attacker to read payment and order data and modify redirect fields. A similar issue affects payment creation, where order ownership is not checked.

Sylius, an Open Source eCommerce Framework on Symfony, contains an authorization bypass vulnerability in the shop account API. The PATCH /api/v2/shop/account/orders/{tokenValue}/payments/{paymentId} endpoint does not validate that the chosen payment method is enabled for the order's channel, allowing an authenticated customer to assign any globally enabled payment method to their order, including methods excluded by the store operator.

Sylius, an Open Source eCommerce Framework on Symfony, contains an improper workflow enforcement vulnerability in the cart FormComponent. When an order is completed while its cart page remains open, the stale LiveComponent does not detect the order's changed state and continues to permit cart actions, allowing an authenticated customer to modify or permanently delete an already completed order.

The source-controller, a Kubernetes operator for acquiring artifacts from external sources, contains a vulnerability in versions 0.0.17 through 1.8.4. An actor able to influence bucket contents can cause writes outside the working directory, and a user with permissions to create/update GitRepository resources can enumerate file paths on the controller pod (only in v1.6.0+).

A flaw was found in gdk-pixbuf. This vulnerability allows a remote attacker to cause a heap out-of-bounds read by providing a specially crafted Apple Icon Image (.icns) file. The uncompress() function, which handles RLE-encoded ICNS icon data, fails to validate the source buffer's boundaries during decompression. This can lead to a denial of service, where the application crashes, or to information disclosure, potentially revealing sensitive data from adjacent memory.

n8n, an open source workflow automation platform, prior to versions 2.37.7 and 2.38.2 did not enforce the workflow setting 'This workflow can be called by' when a workflow was attached to an Agent as a tool. A user able to build an Agent could invoke a restricted workflow and read its returned data.

n8n, an open source workflow automation platform, prior to versions 1.123.76, 2.37.7, and 2.38.2 had a vulnerability in the Git node. The setUpstream function wrote a branch..remote value into repository configuration without validation, and a later fetch or pull used that configuration instead of the checked parameter. An authenticated workflow editor could point Git at any local repository readable by the n8n process and receive its contents.

Prior to versions 1.123.76, 2.37.7, and 2.38.2 of n8n, the /rest/active-workflows endpoint returned every active workflow ID to any member regardless of sharing. Workflow activation, deactivation, and publication push events were also broadcast to clients that could not access the affected workflow, disclosing workflow IDs, version IDs, and activation error details.

Prior to versions 1.123.76, 2.37.7, and 2.38.2 of n8n, a Log Streaming event destination could reference a generic HTTP credential and decrypt whichever credential ID it named without an ownership check. A user with a custom global role carrying Log Streaming scopes could select a credential belonging to another project and send its decrypted secret to an attacker-controlled endpoint.