| CVE |
Vendors |
Products |
Updated |
CVSS v3.1 |
| Sandbox escape due to invalid pointer in the Graphics component. This vulnerability was fixed in Firefox 156, Firefox ESR 140.16, and Firefox ESR 153.3. |
| Site isolation issue in the Graphics component. This vulnerability was fixed in Firefox 156. |
| Incorrect boundary conditions in the Networking: HTTP component. This vulnerability was fixed in Firefox 156. |
| Incorrect boundary conditions in the DOM: Animation component. This vulnerability was fixed in Firefox 156. |
| Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 156. |
| Mitigation bypass in the DOM: Networking component. This vulnerability was fixed in Firefox 156 and Firefox ESR 153.3. |
| Race condition in the DOM: Content Processes component. This vulnerability was fixed in Firefox 156 and Firefox ESR 153.3. |
| Sandbox escape in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, and Firefox ESR 153.3. |
| Use-after-free in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox ESR 140.16. |
| Use-after-free in the XML component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, and Firefox ESR 153.3. |
| Use-after-free in the SVG component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, and Firefox ESR 153.3. |
| Mitigation bypass in the DOM: Copy & Paste and Drag & Drop component. This vulnerability was fixed in Firefox 156, Firefox ESR 140.16, and Firefox ESR 153.3. |
| Animate is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed. |
| Insufficiently protected credentials in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to disclose information over a network. |
| Use-after-free in the Audio/Video: Web Codecs component. This vulnerability was fixed in Firefox 156, Firefox ESR 140.16, and Firefox ESR 153.3. |
| Affected versions of MISP do not consistently apply the existing authentication-failure logging throttle.
Two API authentication failure branches wrote directly to the Log model:
- API requests with no authentication key;
- requests supplying an API key with an incorrect length
Unlike other authentication failures, these paths bypassed _shouldLog(), so every request could create another durable auth_fail entry.
Version affected: ≤2.5.45 |
| Semaphore UI through 2.19.12 exempts GET and HEAD requests from project resource permission checks in GetMustCanMiddleware. Attackers with guest or task_runner roles can read all project environments including plaintext secrets, credentials, and passwords via GET requests to the environment endpoint. |
| Polyaxon through 2.16.4 renders operation specification fields with an unsandboxed Jinja2 environment during server-side run preparation, allowing authenticated users to execute arbitrary code. Attackers can submit runs with Jinja2 payloads in queue, namespace, conditions, presets, or dependencies fields to execute operating system commands in the scheduler process context, exposing database credentials and service tokens. |
| Steedos Platform through 3.0.15-beta.47 contains a reflected cross-site scripting vulnerability in the anonymous /api/page/render endpoint that fails to properly escape query parameters in inline script elements. Attackers can craft malicious links with script-terminating sequences in the schemaApi or data parameters to execute arbitrary JavaScript in victim sessions and steal X-Auth-Token credentials. |
| Affected versions of MISP can record incorrect access-log data for requests that terminate in an exception.
Because CakeErrorController extends AppController, exception rendering runs the application startup path a second time. As a result, __accessMonitor() calls AccessLog::logRequest() twice for one HTTP request. The second deferred writer measures the error-controller execution instead of the original request and can overwrite the row created by the first pass. The corrupted fields include request duration, SQL query count, memory usage, and potentially the recorded query log.
The bug was masked because the same model instance retained the ID of the first saved row, causing the later save to issue an UPDATE rather than insert an obvious duplicate row.
Version affected: ≤2.5.45 |
