CVE Vulnerability Catalog

Use after free in Translate in Google Chrome prior to 151.0.7922.109 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.

Use after free in HTML in Google Chrome prior to 151.0.7922.109 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

Insufficient validation of untrusted input in WebAPKs in Google Chrome on Android prior to 151.0.7922.109 allowed a local attacker to potentially perform a sandbox escape via a malicious file.

Use after free in Views in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page.

Use after free in Resources in Google Chrome on Android prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.

Use after free in GPU in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.

Race in CredentialProvider in Google Chrome on Windows prior to 151.0.7922.109 allowed a local attacker to perform OS-level privilege escalation via a malicious file.

Heap buffer overflow in CrashReporting in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Severity: High)

Use after free in WebGL in Google Chrome on Android prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Severity: Critical)

Insecure direct object reference in the mongodb_memory, elasticsearch_memory, and mem0_memory tools in Amazon Strands Agents Tools before 0.8.3. Remote authenticated users can access, modify, or delete memories belonging to other tenants by influencing the LLM to emit tool calls with a forged namespace parameter.

SQL injection vulnerability in the file /paid/selectall.action in the chiuwingyan house project (up to dea6bcceaebe2b364a5a209747f48ecc2b2dc670). Manipulation of the argument zuname leads to SQL injection, and the attack can be initiated remotely.

The WPC Name Your Price for WooCommerce WordPress plugin before 2.2.5 does not enforce its server-side price allowlist for products configured in "Select" price mode, allowing an unauthenticated visitor to add such a product to the cart at an arbitrary value below the merchant-defined allowed prices and commit a real order at that price.

The miniOrange 2FA WordPress plugin before 6.2.8 does not correctly limit the number of second-factor verification attempts, tracking them against a client-supplied identifier that is reissued on every login, allowing an attacker who already knows a user's password to guess the one-time code without limit and take over the account.

The Payment Plugins for PayPal WooCommerce WordPress plugin before 2.0.20 does not have proper authorization checks on a REST endpoint, allowing unauthenticated users to bypass payments.

The Payment Gateway for Redsys & WooCommerce Lite WordPress plugin before version 7.0.2 does not verify the authenticity of incoming payment-provider notifications for one of its payment methods before marking orders as paid. This allows unauthenticated attackers to forge a payment-confirmation callback and complete their own orders without paying.

An Out-of-Bounds Read vulnerability in Autodesk Revit when parsing a maliciously crafted PDF file. It can lead to a crash, reading sensitive data, or arbitrary code execution in the context of the current process.

The Integrate PhonePe with WooCommerce WordPress plugin through version 1.2.1 does not validate that a verified payment transaction belongs to the order being marked as paid, nor does it verify the authenticity of its payment-completion request. This allows unauthenticated attackers to reuse a single valid transaction to mark arbitrary orders as paid and bypass payment.

The CoCart WordPress plugin before version 4.9.0 does not validate a user-supplied price value against the actual product price when items are added to the cart through one of its public REST API endpoints. This allows unauthenticated users to set arbitrary product prices and complete WooCommerce orders at manipulated totals.

In Packetfence 13.2.0, the WebGui interface setting allows authenticated remote code execution.

An Inefficient Algorithmic Complexity vulnerability in the traversal engine in html_sanitize_ex allows an unauthenticated remote attacker to exhaust server CPU and memory via a flat run of sibling elements in sanitized HTML. The List.flatten operation in Traverser.traverse/2 causes quadratic complexity in sibling count, leading to resource exhaustion.