New vulnerabilities – clearly explained

Google Chrome

Research and translation in progress – available shortly.

Google Chrome

Research and translation in progress – available shortly.

Google Chrome: Use-after-free in GarbageCollection allows code execution

A use-after-free flaw in the GarbageCollection component of Google Chrome before 156.0.8078.79 allows a remote attacker to execute arbitrary code inside the browser sandbox. The attack requires that a victim loads a crafted HTML page, for example via a malicious website, a phishing link or a malicious advertisement. The CVSS base score is 9.6 (critical), and Google rates the Chromium security severity as High.

Google · Chrome

Google Chrome

Research and translation in progress – available shortly.

Google Chrome: Improper input validation in Skia graphics engine

Improper input validation in Skia, the 2D graphics engine of Google Chrome desktop, is listed in the Chrome release notes as High severity. The supplied description calls it a buffer overflow that requires a compromised renderer process, but the release note and research notes do not confirm this, so the weakness type and preconditions must be verified on NVD. Per the description, an attacker could use a crafted HTML page to potentially execute code outside the sandbox. The CVSS score is 9.6 (critical), but the record should be checked before prioritising.

Google · Chrome

Google Chrome: Use after free in Frames allows code execution in sandbox

Google Chrome versions before 156.0.8078.79 contain a use-after-free flaw in the Frames component. A remote attacker can use a crafted HTML page to execute arbitrary code inside the browser sandbox. The attack requires a user to visit the malicious page, for example through a link in a phishing email.

Google · Chrome

Research and translation in progress – available shortly.

Research and translation in progress – available shortly.

Research and translation in progress – available shortly.

Research and translation in progress – available shortly.

Research and translation in progress – available shortly.

Delinea Privilege Manager agent: Unauthenticated remote code execution

The Delinea Privilege Manager Windows agent contains a flaw that allows a remote, unauthenticated attacker to execute arbitrary code as LocalSystem under certain conditions. Successful exploitation would give the attacker full control over the affected endpoint. The enabling conditions are not publicly described, and the CVSS vector (High privileges required, active user interaction) conflicts with the 'unauthenticated' claim, so the advisory needs to be verified.

Delinea · Privilege Manager

Veeam Management Pack for Microsoft System Center: Remote code execution

The Collector service of the Veeam Management Pack for Microsoft System Center contains a vulnerability that allows a member of the Veeam Virtualization Extensions Users group to execute code remotely on the server. The attacker must already hold this group membership, so this is a privilege-escalation step rather than an anonymous entry point. Veeam rates the issue High (CVSS v4.0 8.8), and a successful attack could compromise the management server, which may affect backup infrastructure.

Veeam · Management Pack for Microsoft System Center

Veeam Management Pack: Remote code execution in Collector service

The Veeam Management Pack for Microsoft System Center Collector service contains a flaw that lets an authenticated domain user execute code remotely as the LocalSystem account. The vulnerability affects version 9.0 up to but not including 13.1.0.334 and is classified as CWE-502 (deserialization of untrusted data) by NVD-mirror data, while VulDB lists CWE-94. An attacker needs valid domain credentials but no user interaction, and a successful attack gives full control over the affected server, which is usually domain-joined and privileged.

Veeam · Management Pack for Microsoft System Center

Veeam Management Pack: Unauthenticated remote code execution in Virtualization Extensions

The Veeam Virtualization Extensions service of the Veeam Management Pack for Microsoft System Center contains a flaw that allows an unauthenticated attacker to execute code remotely on the affected server. No valid credentials are required, and the CVSS v4.0 base score is 9.3 (critical). The component runs with elevated privileges and can reach hypervisor and backup infrastructure, so a compromise may have serious consequences. The vendor has published a fix, but version 9.x will not receive one.

Veeam · Management Pack for Microsoft System Center

WeGIA: Stored cross-site scripting in patient record history page

WeGIA, a web manager for charitable institutions, contains a stored cross-site scripting flaw in the textoProntuario field of the medical record history page (saude/historico_prontuarios.php). An attacker who can create or access a patient's medical record can store JavaScript that runs in the browser of another user who opens the affected history page. Successful exploitation can lead to session cookie theft and possible account compromise, depending on the victim's privileges.

LabRedesCefetRJ · WeGIA

SOCFortress CoPilot: Server-side template injection leading to code execution

CoPilot before 0.1.76 renders case-report templates with a non-sandboxed Jinja2 engine. A user with the lowest-privilege customer_user role can upload a manipulated template, and it is executed as Python code when an admin or analyst generates a report. In the reported deployment this allowed command execution as root, exposing data of all tenants and stored connector credentials. The PDF renderer additionally allowed local file reads and requests to internal services.

SOCFortress · CoPilot

Research and translation in progress – available shortly.

WeGIA: Insecure direct object references and missing CSRF checks

WeGIA, a web manager for charitable institutions, does not verify record ownership in its Controle classes and processes request parameters through extract($_REQUEST). Any authenticated user can view, change or delete records of other users, including personal identifiers, addresses, medical records, financial data and employee records. Some controllers also lack CSRF validation, so a malicious web page visited by a logged-in user can trigger changes using that user's session.

LabRedesCefetRJ · WeGIA

Lightdash: Path injection in unauthenticated dbt Cloud webhook

Lightdash, an open-source business intelligence platform, has a dbt Cloud webhook endpoint that accepts requests without authentication. Attacker-supplied accountId and runId values are inserted into the dbt Cloud API URL without sanitization, so path traversal can redirect the server's request, which carries the project's API key, to another path on cloud.getdbt.com. The attacker must know the project UUID, and the target must be a dbt Cloud IDE project. The advisory's claim of API key theft is not established by the evidence, and the CVSS and CWE ratings conflict between sources.

Lightdash · Lightdash

Docat: Arbitrary file upload in Upload API

Docat, a tool for hosting versioned static documentation, does not validate the path or type of files sent to its Upload API. An attacker who can reach the API can overwrite sensitive configuration files or place malicious files on the web server. Depending on the deployment, this can lead to remote code execution or cross-site scripting. Whether an attacker needs a login or API key in a default setup is unknown.

docat-org · docat

OpenAM: Session token disclosure in CDSSO servlet

OpenAM, an access management solution, exposes a logged-in user's raw session token through its Cross-Domain Single Sign-On (CDSSO) servlet. An attacker who gets an authenticated victim to visit a crafted URL can receive the token and may hijack the session. Exploitation requires CDSSO to be enabled, which is common in multi-domain deployments, and a non-default configuration that the sources do not name.

Open Identity Platform · OpenAM

Research and translation in progress – available shortly.

GraphQL-core: Denial of service via memory leak in aborted validations

graphql-core, a Python port of the GraphQL.js reference implementation, leaks memory when a GraphQL document produces more than 100 validation errors. Each aborted validation adds frames to a shared exception object, so documents and validation contexts stay in memory for the lifetime of the process. An unauthenticated attacker can repeatedly send a small query to exhaust worker memory before execution, causing a denial of service, without disclosing or modifying data.

graphql-python · graphql-core

Research and translation in progress – available shortly.