Man Yue Mo

Sentry هي أداة لتتبع الأخطاء ومراقبة الأداء مصممة خصيصًا للمطورين. تحتوي الإصدارات السابقة للإصدار 26.1.0 على مشكلة «الإشارة المباشرة غير الآمنة إلى الكائنات» (IDOR) عبر المؤسسات في نقطة النهاية `GroupEventJsonView`. تحدث «الإشارة المباشرة غير الآمنة إلى الكائنات» عندما يستخدم التطبيق المدخلات التي يقدمها المستخدم للوصول مباشرةً إلى الكائنات، مما قد يسمح بالوصول غير المصرح به إلى البيانات.

اسم البرنامج المعرض للخطر والإصدارات المتأثرة: إصدارات Apache Doris الأقدم من 2.1.8 إصدارات Apache Doris الأقدم من 3.0.3 الوصف: تسمح هذه الثغرة لمسؤولي التطبيق بقراءة ملفات عشوائية من نظام ملفات الخادم عبر «اجتياز المسار» (path traversal)، وهو نوع من الثغرات الأمنية يُعرف باسم «التقييد غير الصحيح لمسار ملف في دليل مقيد». ويمكن استغلال هذه الثغرة عبر واجهة برمجة التطبيقات REST. التوصيات: بالنسبة لإصدارات Apache Doris الأقدم من 2.1.8، قم بالتحديث إلى الإصدار 2.1.8 أو أحدث لإصلاح الثغرة. بالنسبة لإصدارات Apache Doris الأقدم من 3.0.3، قم بالتحديث إلى الإصدار 3.0.3 أو أحدث لإصلاح الثغرة. كإجراء تجاوبي مؤقت، يُنصح بتقييد الوصول إلى واجهة برمجة التطبيقات REST لتقليل مخاطر الاستغلال.

The issue is related to object corruption in WebAssembly, which could allow a remote attacker to potentially exploit object corruption via a crafted HTML page. This is due to a buffer overflow in memory. The estimated number of potentially affected devices worldwide is not specified. There is no information about real-world incidents where this issue was exploited.

The issue is related to object corruption in the V8 JavaScript engine used by Google Chrome and Microsoft Edge browsers. It involves a memory corruption vulnerability that can be exploited by a remote attacker through a specially crafted HTML page, potentially allowing the execution of arbitrary code. The severity of this issue is considered high.

The issue is related to a type confusion in the V8 JavaScript engine, which can potentially allow a remote attacker to exploit heap corruption via a crafted HTML page. This can lead to arbitrary code execution. The Chromium security severity of this issue is High.

The issue is related to a type confusion vulnerability in the V8 engine of Google Chrome, allowing a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability can lead to remote code execution. The Chromium security severity of this issue is High.

The issue is related to type confusion in the V8 JavaScript engine of Google Chrome, which can lead to heap corruption. A remote attacker can potentially exploit this issue by using a specially crafted HTML page, allowing them to execute arbitrary code. The severity of this issue is considered high.

The issue is related to the mishandling of GPU memory operations, allowing unprivileged users to access freed memory. This can lead to a denial of service. The estimated number of potentially affected devices is not provided. There is no information about real-world incidents where this issue was exploited. The vulnerability is related to the use of memory after it has been freed, which can be exploited by a remote attacker.

The issue is related to a type confusion error in the V8 JavaScript engine of Google Chrome, which could allow a remote attacker to exploit heap corruption via a crafted HTML page. This could potentially lead to the disclosure of protected information.

The issue is related to a type confusion in the V8 JavaScript engine, which can lead to heap corruption. A remote attacker can potentially exploit this issue via a crafted HTML page, allowing them to execute arbitrary code.

Name of the Vulnerable Software and Affected Versions: Qualcomm Snapdragon (affected versions not specified) Description: The issue is related to improper validation of kernel buffer address while copying information back to user buffer, which can lead to kernel memory information exposure to user space. This affects various Qualcomm Snapdragon products, including Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, and Snapdragon Wearables. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Qualcomm npu driver (affected versions not specified) Description: The issue is related to improper validation of kernel buffer address while copying information back to user buffer, which can lead to kernel memory information exposure to user space. This affects various Snapdragon products, including Auto, Compute, Consumer IOT, Industrial IOT, Mobile, Voice & Music, and Wearables. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Qualcomm Snapdragon (affected versions not specified) Description: The issue arises from improper handling of responses from firmware, potentially leading to use after free. This affects various Qualcomm Snapdragon products, including Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, and Snapdragon Wearables. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

The issue is related to a use after free vulnerability in the WebAuthentication component of Google Chrome. This could allow a remote attacker who has compromised the renderer process of a user, particularly one who has saved a credit card in their Google account, to potentially exploit heap corruption via a crafted HTML page.

The issue is related to type confusion in the V8 JavaScript engine, which can lead to heap corruption. A remote attacker can exploit this by using a specially crafted HTML page, potentially gaining access to sensitive data, disrupting data integrity, and causing a denial of service.

The issue is related to a use after free in the audio component, which could allow a remote attacker to potentially exploit heap corruption via a crafted HTML page. This could impact the confidentiality, integrity, and availability of protected information.

The issue is related to a use after free in the payments component of Google Chrome, which could allow a remote attacker who has compromised the renderer process to potentially perform a sandbox escape. This can be achieved via a crafted HTML page. The attacker may be able to execute arbitrary code.

The issue is related to a use after free in the payments component of Google Chrome, which could allow a remote attacker to potentially perform a sandbox escape via a crafted HTML page. This could enable the attacker to bypass existing security restrictions.

The issue is related to a use after free in the WebAudio component, which can be exploited by a remote attacker via a crafted HTML page. This could potentially lead to heap corruption, allowing the attacker to gain unauthorized access to sensitive data, cause a denial of service, or impact data integrity.

The issue is related to a use after free error in the audio component of Google Chrome, which can be exploited by a remote attacker to potentially access sensitive data, compromise data integrity, and cause a denial of service. This can be achieved via a crafted HTML page, allowing for heap corruption.