CVE Vulnerability Catalog

An information disclosure and privilege escalation vulnerability in the Security: Process Sandboxing component. It was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

A sandbox escape vulnerability in the Networking component of Firefox and Thunderbird is caused by incorrect boundary conditions. It was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, Thunderbird 153.5, and Firefox ESR 115.44.

A use-after-free vulnerability in the Networking component of Firefox and Thunderbird enables a sandbox escape. It was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, Thunderbird 153.5, and Firefox ESR 115.44.

Use-after-free vulnerability in the Storage: IndexedDB component of Firefox and Thunderbird. It can lead to arbitrary code execution or application crash. The issue was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

A vulnerability in the Networking component of Firefox and Thunderbird combines incorrect boundary conditions and use-after-free, leading to a sandbox escape and site isolation issue. It was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, Thunderbird 153.5, and Firefox ESR 115.44.

Privilege escalation in the Application Update component. The vulnerability was fixed in Firefox 158, Firefox ESR 153.5, and Thunderbird 158 and 153.5.

A security vulnerability has been detected in macrozheng mall up to 1.0.3. The issue affects the file /order/generateOrder in the Coupon Redemption component. Manipulation of the couponId argument leads to a race condition. The attack can be performed remotely but requires high complexity and is difficult to exploit. The vendor deleted the GitHub issue without explanation.

A weakness has been identified in macrozheng mall up to 1.0.3. This vulnerability affects the function OmsPortalOrderServiceImpl of the file /order/generateOrder of the mall-portal component. Manipulation of the coupon_amount/pay_amount arguments causes business logic errors, remotely exploitable. The vendor deleted the GitHub issue for this vulnerability without explanation.

A security flaw has been discovered in conductor-oss conductor up to 3.33.0-rc10. This affects the function KafkaPublishTask.start of the file kafka/src/main/java/com/netflix/conductor/contribs/tasks/kafka/KafkaPublishTask.java. The manipulation of the argument kafka_request.bootStrapServers results in server-side request forgery. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks.

A vulnerability was identified in conductor-oss conductor up to 3.33.0-rc10. It affects some unknown functionality of the file AgentController.java of the Agentspan Agent Runtime component. The manipulation leads to server-side request forgery, remotely exploitable.

A vulnerability was found in conductor-oss conductor up to 3.32.5 in the A2AService.getAgentCard function of A2AService.java, within the Agent Card Fetching component. Manipulating the agentUrl argument allows server-side request forgery, exploitable remotely. The exploit has been publicly disclosed and may be utilized.

A low privileged remote attacker is able to view a list of roles that should only be accessible to administrators. This results in a low level of confidentiality breach, as no particularly sensitive information is affected.

Cross-Site request forgery (CSRF) vulnerability in AuthTake Technology Inc. Authtake allows Encryption Brute Forcing. This issue affects authtake from v1.3 before v1.4.

A SQL injection vulnerability was identified in Payload CMS. Improper neutralization of user input in the "in" and "not_in" query parameters allows an authenticated attacker to perform SQL Injection attacks. The issue was fixed in versions 3.90.0 and 4.0.0-canary.34.

A flaw was found in gnome-remote-desktop as shipped in Red Hat Enterprise Linux. In the VNC TLS I/O handlers, retryable GnuTLS results (GNUTLS_E_AGAIN and GNUTLS_E_INTERRUPTED) are handled with an unbounded busy loop instead of yielding to the event loop. A remote attacker who can reach an enabled VNC TLS listener can cause the event-loop thread to spin at high CPU with no forward progress, resulting in denial of service.

In conductor-oss conductor 3.22.0, the MCPService.listTools function in MCPService.java (MCP Service component) improperly handles the mcpServer argument, leading to Server-Side Request Forgery (SSRF). The attack can be initiated remotely, and the exploit has been made public.

In conductor-oss conductor 3.31.2, the ListApiToolsTask.start function in ListApiToolsTask.java (API Tool Configuration component) improperly handles the specUrl argument, leading to Server-Side Request Forgery (SSRF). The attack can be carried out remotely, and the exploit has been disclosed to the public.

In fit2cloud MeterSphere up to 3.6.9-lts, the Swagger3ParserApiDefinition.testUrlTimeout function in Swagger3ParserApiDefinition.java (Swagger3 Parser component) improperly handles the swaggerUrl argument, leading to Server-Side Request Forgery (SSRF). The attack can be carried out remotely, and the exploit is now public. The vendor was contacted but did not respond.

A vulnerability was determined in PublicCMS up to 5.202608.a. Affected by this issue is the function SafeConfigComponent.getSafeUrl of the file publiccms-core/src/main/java/com/publiccms/logic/component/config/SafeConfigComponent.java of the component pay Endpoint. Executing a manipulation of the argument returnUrl can lead to open redirect. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

The TRENDnet TEW-432BRP router version 3.10B20 contains a stack-based buffer overflow in the formTcpipSetup function of /goform/formTcpipSetup. Manipulating the Name argument allows remote attack, and the exploit has been publicly disclosed.