CVE Vulnerability Catalog

Incorrect Authorization in SiteIsolation in Google Chrome prior to 155.0.8059.39. A remote attacker could execute arbitrary code via a crafted HTML page. (Severity: High)

Quasar Framework before 2.22.0 has a vulnerability in the SSR-only getHead() serializer that fails to properly encode values supplied via useMeta(). An attacker who can influence dynamic page metadata can inject executable HTML markup before hydration. The client-side path is not affected because it uses DOM APIs that encode attributes.

Payload CMS in versions after 3.0.0 and before 3.90.0 allows a custom field option that maps a field to a reserved authentication claim name to place unintended values in the authentication token issued at login. This issue is fixed in version 3.90.0.

Payload CMS before 3.90.0 and canary versions before 4.0.0-canary.34 has a vulnerability that allows an attacker to modify collection documents without enforcing collection or field-level access control when orderable is enabled. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34.

The @payloadcms/plugin-form-builder plugin in versions before 3.90.0 and canary versions before 4.0.0-canary.34 has a vulnerability that allows an attacker to execute code remotely on the server via a crafted form submission. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34.

Payload is a free and open source headless content management system. In @payloadcms/plugin-stripe versions before 3.90.0 and canary versions before 4.0.0-canary.34, an authenticated user who can reach the enabled optional Stripe REST proxy can perform unintended Stripe operations.

The Crayons plugin for SPIP before 3.5.0 contains a missing authorization vulnerability that allows unauthenticated attackers to modify arbitrary editable object fields by omitting the secu_ anti-forgery parameter in crayons_store.php. Attackers can chain this flaw to write a malicious .html skeleton file, disclose sensitive configuration files containing the site secret, and forge a signed ajax context to execute the uploaded skeleton, achieving arbitrary PHP code execution as the web-server user.

Dbit WIFI4 N300 devices version 1.0.0 allow the management interface to be crashed via a request (from the local Wi-Fi network) that lacks a /api/login username or password field. This occurs because of an error in a JSON parser.

Dell Container Storage Modules before version 1.18.0 contain an Improper Neutralization of Special Elements Used in a Template Engine vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to elevation of privileges.

Payload CMS in versions from 3.0.0 before 3.88.0 and canary versions before 4.0.0-canary.27 has a vulnerability that allows an untrusted user who can query readable collections through dynamic filters or joins to submit a request that causes SQL injection in the SQLite and Postgres adapters. This issue is fixed in versions 3.88.0 and 4.0.0-canary.27.

Payload CMS in versions from 3.0.0 before 3.88.0 and canary versions before 4.0.0-canary.27 has a vulnerability that allows an unauthenticated user to submit prototype-sensitive field paths when @payloadcms/plugin-import-export is enabled, causing unintended application behavior that can lead to remote code execution. This issue is fixed in versions 3.88.0 and 4.0.0-canary.27.

Dell Container Storage Modules (CSM) Operator prior to version 1.18.0 contains an Improper Privilege Management vulnerability in the ContainerStorageModule Custom Resource reconciler. A low privileged remote attacker could exploit this vulnerability to escalate privileges and gain root-level access on cluster nodes.

Dell Container Storage Modules prior to version 1.18.0 contains a Missing Authentication for Critical Function vulnerability. An unauthenticated attacker with remote access could exploit this vulnerability to elevate privileges.

Dell Container Storage Modules (CSM) prior to v1.18.0 contains a Missing Authentication for Critical Function vulnerability in the csm-authorization-storage gRPC server. An unauthenticated remote attacker could exploit this vulnerability to gain unauthorized access to storage backend administrator credentials for all registered storage arrays.

Dell Container Storage Modules prior to version 1.18.0 contains a Use of Hard-coded Credentials vulnerability in CSM Authorization. An unauthenticated attacker with remote access could exploit this vulnerability to elevate privileges.

Dell Container Storage Modules prior to version 1.18.0 contains a Use of Hard-coded Credentials vulnerability in csm-docs. An unauthenticated attacker with remote access could exploit this vulnerability to disclose information.

MsQuic prior to versions 2.4.20, 2.5.11, and 2.6.1 contains a vulnerability where clients using the OpenSSL or QuicTLS TLS backend do not properly verify that a server certificate matches the intended target server hostname. An on-path attacker can present a certificate that does not match the intended hostname and spoof the server in a man-in-the-middle attack. The Schannel backend is not affected.

Microsoft UFO prior to version 3.0.9 contains a command injection vulnerability in the press_key tool in ufo/client/mcp/http_servers/mobile_mcp_server.py. The key_code parameter is passed to `adb shell input keyevent`, and the adb client joins arguments into a remote command string, allowing an authenticated Mobile MCP caller to execute additional commands as the Android shell user on an authorized connected device. This requires a valid UFO_MCP_API_KEY, adb on the host, and a reachable authorized device.

Progress Software Autonomous REST Connector GenAI Agents ARCGenAI-Generator version 2.0 contains an OS command injection vulnerability in the shell-based temporary-file cleanup instructions. An attacker who supplies a crafted Swagger/OpenAPI document can execute arbitrary commands on a developer's machine when a user invokes the generator.

Oracle VM VirtualBox before 7.2.8 allows guest OS users to cause an out-of-bounds write in the host OS in pcnetReceiveNoSync in DevPCNet.cpp in the PCNet (Am79C970A) network device model.