CVE-2023-22650

This CVE concerns Rancher not automatically cleaning up deleted/disabled users from the configured authentication provider, leaving tokens usable and potentially granting continued access. Concrete details from connected sources show the issue affects Rancher and involves user accounts that persi...

CVE-2022-25776

The CVE-2022-25776 issue affects Mautic prior to patched versions. Affected product: Mautic (open-source marketing automation). Vulnerability: logged-in users can access areas of the application they should be denied, enabling potential exposure of sensitive data (names, surnames, company names, ...

CVE-2022-25774

CVE-2022-25774 affects Mautic prior to 4.4.12. A self‑XSS in the notifications you save for Dashboards allows logged‑in users to inject/execute JavaScript in the notification content. Remediation: update to Mautic 4.4.12 or later. No exploitation details are provided in the supplied documents.

CVE-2023-30587

A vulnerability in Node.js version 20 allows for bypassing restrictions set by the --experimental-permission flag using the built-in inspector module node:inspector. By exploiting the Worker class's ability to create an "internal worker" with the kIsInternal Symbol, attackers can modify the...

CVE-2023-30584

CVE-2023-30584 affects Node.js 20 with the experimental permission model. It describes a path traversal bypass in how file permissions are verified due to improper handling within the experimental permission model. The vulnerability is described as local with high confidentiality and integrity im...

CVE-2023-30583

fs.openAsBlob can bypass the experimental permission model when using the file system read restriction with the --allow-fs-read flag in Node.js 20. This flaw arises from a missing check in the fs.openAsBlob API. Please note that at the time this CVE was issued, the permission model is an...

CVE-2024-5148

The CVE-2024-5148 issue affects the gnome-remote-desktop package. The gnome-remote-desktop system daemon inadequately validates session-handover via D-Bus during the login screen-to-user session transition, allowing a malicious local user to take control of the RDP client connection and potential...

CVE-2023-7012

CVE-2023-7012 affects Google Chrome’s Permission Prompts due to insufficient data validation, potentially enabling a sandbox escape when a user runs a malicious app. Described for Chrome versions before 117.0.5938.62; exploitation requires user interaction and a malicious file. Astra Linux bullet...

CVE-2019-25154

The CVE-2019-25154 entry describes an Inappropriate implementation in iframe handling in Google Chrome prior to 77.0.3865.75, which could allow a remote attacker to potentially perform a sandbox escape via a crafted HTML page. Affected software is Google Chrome (Chromium-based); the underlying is...

CVE-2024-3175

CVE-2024-3175 concerns insufficient data validation in the Chrome Extensions component, enabling privilege escalation via a crafted Chrome Extension. The primary documentation states vulnerable component as Extensions, with affected Chrome versions before 120.0.6099.62 (remediation: update to 120...

CVE-2024-3172

CVE-2024-3172 concerns Insufficient data validation in DevTools of Google Chrome prior to 121.0.6167.85. A remote attacker could trick a user into UI gestures to execute arbitrary code via a crafted HTML page. Affected software: Google Chrome (DevTools). Root cause: input/data validation gaps in ...

CVE-2024-34721

CVE-2024-34721 describes an information-disclosure in Android’s MediaProvider.java, in ensureFileColumns, where improper input validation may allow a user to disclose files owned by another user. This is a local disclosure with no extra execution privileges required and does not require user inte...

CVE-2024-34726

The CVE-2024-34726 issue is in PVRSRV_MMap (pvr_bridge_k.c) of the PVR bridge kernel module. A logic error in PVRSRV_MMap can allow arbitrary code execution, enabling local kernel escalation of privilege with no extra execution privileges and without user interaction. The available documents do n...

CVE-2024-31335

The CVE-2024-31335 entry concerns a logic error in DevmemIntChangeSparse2 within devicemem_server.c that can enable arbitrary code execution with local privilege elevation in the kernel. Connected sources indicate affected components include Android’s kernel-related stack and PowerVR-GPU subcompo...

CVE-2024-31327

CVE-2024-31327 affects Android/libfmq: multiple functions in MessageQueueBase.h may cause an out-of-bounds write due to a race, enabling local escalation of privilege with no user interaction. Exploitation specifics are not provided in the supplied documents. Android security references acknowled...

CVE-2024-31318

CVE-2024-31318 affects Android’s CompanionDeviceManagerService.java. The flaw is a missing permission check that could allow pairing a companion device without user acceptance, enabling local elevation of privilege with no extra execution privileges required. User interaction is not needed for ex...

CVE-2024-31324

CVE-2024-31324 affects Android Framework due to a tapjacking/overlay bypass in WindowState.java. The issue can be triggered by starting an activity in portrait, then rotating to landscape, enabling local elevation of privilege with user interaction required. The entry notes exploitation is possib...

CVE-2024-31319

CVE-2024-31319 affects Android Framework (NotificationManagerService.java). A cross-user data leak caused by a confused deputy could lead to local escalation of privilege with no extra execution privileges required. Exploitation is described as local and independent of user interaction. Public de...

CVE-2024-31326

CVE-2024-31326 affects the Android Framework. The issue is a logic error in policy migration code that can lead to local elevation of privilege without extra privileges or user interaction. The Android bulletin notes this as an EoP vulnerability with High severity, and lists updated AOSP versions...

CVE-2024-23697

CVE-2024-23697: A use-after-free in RGXCreateHWRTData_aux (rgxta3d.c) enables possible arbitrary code execution and local kernel privilege escalation. No user interaction required. Documents consistently describe this as a local-privilege escalation vulnerability with kernel impact and do not pro...