Leo

A buffer overflow exists in Dawn, a WebGPU implementation, which allows a remote attacker to potentially execute arbitrary code outside the sandbox by inducing the user to visit a crafted HTML page.

A memory calculation bug in the `mod dav` module allows an attacker with permissions to create WebDAV locks to crash server child processes. Approximately 596.5 million instances are identified globally.

A type confusion issue exists in V8, the open-source JavaScript and WebAssembly engine. This flaw allows a remote attacker to execute arbitrary code within the sandbox by inducing the victim to visit a specially crafted HTML page. Real-world exploitation has been demonstrated using a chain of bugs to achieve a V8 sandbox escape and gain program counter control on arm64 architectures.

A type confusion issue exists in the V8 engine, which is the open-source JavaScript and WebAssembly engine used by Google Chrome. This flaw allows a remote attacker to execute arbitrary code within the sandbox by inducing the browser to process a specially crafted HTML page.

The `internal-sftp` component in `sshd` only recognizes the first 9 command-line arguments. This limitation may compromise security properties if critical configuration arguments are placed beyond the ninth position and are consequently ignored by the system.

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 147.0.7727.55 Description A use-after-free issue existed in the V8 component of Google Chrome before version 147.0.7727.55. An attacker could potentially exploit heap corruption by convincing a user to install a malicious extension. Recommendations Update Google Chrome to version 147.0.7727.55 or later.

An object lifecycle issue in the DevTools component of Google Chrome allowed an attacker to potentially exploit heap corruption. This exploitation could occur if a user was convinced to install a malicious extension. The security severity is rated as High.

A type confusion issue exists in the V8 component of Google Chrome. This could allow a remote attacker to exploit heap corruption through a specially crafted HTML page. The Chromium security severity is rated as High.

The FluentSMTP plugin for WordPress is vulnerable to PHP Object Injection via deserialization of untrusted input in the `formatResult` function. This allows unauthenticated attackers to inject a PHP object. No known POP chain is present in the vulnerable software, but if a POP chain is present via an additional plugin or theme, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code. The vulnerability was partially patched in version 2.2.82. Over 300,000 WordPress sites are potentially exposed to this issue.

The issue is related to PHP Object Injection via deserialization of untrusted input in the `set redirections` function. This allows authenticated attackers with Administrator-level access and above to inject a PHP Object. No known POP chain is present in the vulnerable software, but if a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.

The issue is caused by a missing capability check on the `update metadata` function, allowing unauthenticated attackers to insert new and update existing metadata beginning with `rank math`, and delete arbitrary existing user metadata and term metadata. This can lead to a loss of access to the administrator dashboard for any registered users, including Administrators.

Name of the Vulnerable Software and Affected Versions: Code Embed plugin for WordPress versions up to, and including, 2.4 Description: The issue is related to Stored Cross-Site Scripting via the plugin's script embed functionality due to insufficient restrictions on who can utilize the functionality. This allows authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Recommendations: For Code Embed plugin for WordPress versions up to, and including, 2.4: Update to the latest patched version as soon as possible to mitigate the risk of exploitation. Additionally, consider monitoring for signs of compromise.

The issue is related to time-based SQL Injection via the `order` parameter due to insufficient escaping on the user-supplied parameter and lack of sufficient preparation on the existing SQL query. This allows authenticated attackers, with GiveWP Manager-level access and above, to append additional SQL queries into already existing queries within the Legacy View mode, which can be used to extract sensitive information from the database.