| CVE |
Vendors |
Products |
Updated |
CVSS v3.1 |
| Use after free in Streaming in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium) |
| Memory corruption in FileSystem in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium) |
| Out of bounds read in API in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Medium) |
| Memory corruption in HTML in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low) |
| Use after free in WebSockets in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium) |
| Memory corruption in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Low) |
| Use after free in Bookmarks in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low) |
| Use of uninitialized resource in Windows Win32 Kernel Subsystem allows an authorized attacker to disclose information locally. |
| Heap-based buffer overflow in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally. |
| The `insights-operator-gather` ClusterRole grants the operator's service account read access to secrets in the core API group with no namespace or resourceNames restriction — therefore, access to every secret in every namespace in the cluster.
Ref: https://github.com/openshift/insights-operator/blob/8f15e3157ff09f54ab22801f5b21da35a195cc6d/manifests/03-clusterrole.yaml#L368-L373
```
- apiGroups:
- ""
resources:
- secrets
verbs:
- get
- list
```
By spawning a pod with the gather service account mounted, an attacker will be able to access any secret in any namespace.
```
spec:
serviceAccountName:"gather"
``` |
| A flaw was found in the OpenShift console. An authenticated console user can exploit a Server-Side Request Forgery (SSRF) vulnerability by providing a specially crafted Helm chart URL without proper validation. This allows the user to make the console pod fetch arbitrary URLs, potentially leading to the disclosure of sensitive information through error messages or enabling blind port scanning within the cluster. |
| Time-of-check time-of-use (toctou) race condition in Windows Win32 Kernel Subsystem allows an authorized attacker to disclose information locally. |
| Cryptographic issue in the Security Block-lists, Allow-lists, and other State component. This vulnerability was fixed in Firefox 158.0.1, Firefox ESR 153.5.1, Firefox ESR 115.43.1, Thunderbird 158.0.1, Thunderbird 153.5.1, and Firefox 158.0.2. |
| Out-of-bounds read in Windows Win32 Kernel Subsystem allows an authorized attacker to disclose information locally. |
| Use of uninitialized resource in Windows Win32 Kernel Subsystem allows an authorized attacker to disclose information locally. |
| Out-of-bounds read in Windows Win32 Kernel Subsystem allows an authorized attacker to disclose information locally. |
| In OpenStack Cinder through 29.0.0, cross-project information disclosure can occur in the Messages API. A non-admin user with the project-scoped 'member' or 'reader' role making the Block Storage API v3.3 "List messages" call finds the non-expired user messages for other projects included in the response, resulting in the leakage of UUIDs of resources owned by other projects, in addition to the user message about the other projects' resources (which, by design, are sanitized generic messages). All Cinder deployments are affected. |
| Missing authentication for critical function vulnerability in Apache IoTDB.
This issue affects Apache IoTDB: from 2.0.0 before 2.0.11.
Users are recommended to upgrade to version 2.0.11, which fixes the issue. |
| The Legacy Pipe receiver protocol (handshake / sendPipeData) uses a
hardcoded SUPER_USER (root) identity when executing data loading and
deletion operations. A user with only SYSTEM-level privileges (such as
USE_PIPE or MAINTAIN) who does NOT have WRITE_DATA or DELETE_DATA
permissions on target databases can send specially crafted PipeData
messages through the Legacy Pipe API, resulting in data loading/deletion
operations executed as root — effectively bypassing IoTDB's permission
model entirely.
This issue affects Apache IoTDB: from 2.0.0 before 2.0.11.
Users are recommended to upgrade to version 2.0.11, which fixes the issue. |
| Uncontrolled Resource Consumption vulnerability in Apache IoTDB JDBC driver.
This issue affects Apache IoTDB JDBC driver: from 1.3.3 before 2.0.11.
Users are recommended to upgrade to version 2.0.11, which fixes the issue. |
