CVE-2024-5844

Heap buffer overflow in Tab Strip in Google Chrome prior to 126.0.6478.54 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. Chromium security severity: Medium...

CVE-2024-5847

Use after free in PDFium in Google Chrome prior to 126.0.6478.54 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file. Chromium security severity: Medium...

CVE-2024-5843

Inappropriate implementation in Downloads in Google Chrome prior to 126.0.6478.54 allowed a remote attacker to obfuscate security UI via a malicious file. Chromium security severity: Medium...

CVE-2024-5841

Use after free in V8 in Google Chrome prior to 126.0.6478.54 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: Medium...

CVE-2024-5839

Inappropriate Implementation in Memory Allocator in Google Chrome prior to 126.0.6478.54 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: Medium...

CVE-2024-5843

Inappropriate implementation in Downloads in Google Chrome prior to 126.0.6478.54 allowed a remote attacker to obfuscate security UI via a malicious file. Chromium security severity: Medium...

CVE-2024-5840

Summary of CVE-2024-5840: Google Chrome/Chromium prior to 126.0.6478.54 is affected by a CORS policy bypass vulnerability that can let remote attackers bypass discretionary access control via a crafted HTML page. The vulnerability target is the browser’s CORS handling (Chromium component). Report...

CVE-2024-5843

Google Chrome versions prior to 126.0.6478.54 are vulnerable to a vulnerability in the Downloads component. Due to an inappropriate implementation, a remote attacker can use a malicious file to obfuscate security UI . The security severity for Chromium is classified as Medium , though some metric...

CVE-2024-5840

Policy bypass in CORS in Google Chrome prior to 126.0.6478.54 allowed a remote attacker to bypass discretionary access control via a crafted HTML page. Chromium security severity: Medium...

CVE-2024-5839

Inappropriate Implementation in Memory Allocator in Google Chrome prior to 126.0.6478.54 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: Medium...

CVE-2024-5840

Policy bypass in CORS in Google Chrome prior to 126.0.6478.54 allowed a remote attacker to bypass discretionary access control via a crafted HTML page. Chromium security severity: Medium...

CVE-2024-5842

Use after free in Browser UI in Google Chrome prior to 126.0.6478.54 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform an out of bounds memory read via a crafted HTML page. Chromium security severity: Medium...

CVE-2024-5843

Inappropriate implementation in Downloads in Google Chrome prior to 126.0.6478.54 allowed a remote attacker to obfuscate security UI via a malicious file. Chromium security severity: Medium...

CVE-2024-5813 SSH Private Key Leak in BeyondInsight PasswordSafe

A medium severity vulnerability in BIPS has been identified where an authenticated attacker with high privileges can access the SSH private keys via an information leak in the server response...

Stable Channel Update for Desktop

The Chrome team is delighted to announce the promotion of Chrome 126 to the stable channel for Windows, Mac and Linux. This will roll out over the coming days/weeks. Chrome 126.0.6478.54 Linux 126.0.6478.56/57 Windows, Mac contains a number of fixes and improvements -- a list of changes is...

WordPress Bookly Plugin <= 23.2 is vulnerable to Cross Site Scripting (XSS)

Software Bookly Type Plugin Vulnerable versions = 23.2 Fixed in 23.3 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-5584 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 6392bd62a07f Credits 0xBishop Required privilege...

WordPress Pearl Plugin <= 1.3.7 is vulnerable to Broken Access Control

Software Pearl Type Plugin Vulnerable versions = 1.3.7 Fixed in 1.3.8 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-5468 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 816d74377350 Credits Lucio Sá Required privilege...

miniz:zip_fuzzer: Heap-buffer-overflow in mz_zip_mem_read_func

Project: https://github.com/richgel999/miniz.git Detailed Report: https://oss-fuzz.com/testcase?key=5362290995036160 Project: miniz Fuzzing Engine: libFuzzer Fuzz Target: zipfuzzer Job Type: libfuzzerasanminiz Platform Id: linux Crash Type: Heap-buffer-overflow READ Crash Address: 0x507000000144...

pcapplusplus:FuzzTargetNg: Use-of-uninitialized-value in pcpp::SomeIpLayer::parseSomeIpLayer

Project: https://github.com/seladb/PcapPlusPlus.git Detailed Report: https://oss-fuzz.com/testcase?key=6639796737867776 Project: pcapplusplus Fuzzing Engine: libFuzzer Fuzz Target: FuzzTargetNg Job Type: libfuzzermsanpcapplusplus Platform Id: linux Crash Type: Use-of-uninitialized-value Crash...

WordPress Master Addons for Elementor Plugin <= 2.0.6.1 is vulnerable to Broken Access Control

Software Master Addons for Elementor Type Plugin Vulnerable versions = 2.0.6.1 Fixed in 2.0.6.2 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-5382 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 62e303c589aa Credits Webberna...