CVSS: 7.5EPSS: 0%CPEs: 12EXPL: 1CVE-2024-7055 – FFmpeg pnmdec.c pnm_decode_frame heap-based overflow
https://notcve.org/view.php?id=CVE-2024-7055
06 Aug 2024 — A vulnerability was found in FFmpeg up to 7.0.1. It has been classified as critical. This affects the function pnm_decode_frame in the library /libavcodec/pnmdec.c. The manipulation leads to heap-based buffer overflow. It is possible to initiate the attack remotely. • https://ffmpeg.org • CWE-122: Heap-based Buffer Overflow •
CVSS: 9.4EPSS: 49%CPEs: 5EXPL: 2CVE-2024-42009 – Debian Security Advisory 5743-1
https://notcve.org/view.php?id=CVE-2024-42009
05 Aug 2024 — A Cross-Site Scripting vulnerability in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attacker to steal and send emails of a victim via a crafted e-mail message that abuses a Desanitization issue in message_body() in program/actions/mail/show.php. Multiple cross-site scripting vulnerabilities were discovered in RoundCube webmail. • https://github.com/0xbassiouny1337/CVE-2024-42009 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.4EPSS: 9%CPEs: 5EXPL: 1CVE-2024-42008 – Debian Security Advisory 5743-1
https://notcve.org/view.php?id=CVE-2024-42008
05 Aug 2024 — A Cross-Site Scripting vulnerability in rcmail_action_mail_get->run() in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attacker to steal and send emails of a victim via a malicious e-mail attachment served with a dangerous Content-Type header. Multiple cross-site scripting vulnerabilities were discovered in RoundCube webmail. • https://github.com/victoni/Roundcube-CVE-2024-42008-and-CVE-2024-42010-POC • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 0%CPEs: 5EXPL: 0CVE-2024-42010 – Debian Security Advisory 5743-1
https://notcve.org/view.php?id=CVE-2024-42010
05 Aug 2024 — mod_css_styles in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a insufficiently filters Cascading Style Sheets (CSS) token sequences in rendered e-mail messages, allowing a remote attacker to obtain sensitive information. mod_css_styles in Roundcube through 1.5.7 and 1.6.x through 1.6.7 insufficiently filters Cascading Style Sheets (CSS) token sequences in rendered e-mail messages, allowing a remote attacker to obtain sensitive information. Multiple cross-site scripting vulnerabilities were discov... • https://github.com/roundcube/roundcubemail/releases • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 7.8EPSS: 0%CPEs: 3EXPL: 0CVE-2024-6992 – Debian Security Advisory 5735-1
https://notcve.org/view.php?id=CVE-2024-6992
01 Aug 2024 — update to 127.0.6533.88 * Critical CVE-2024-6990: Uninitialized Use in Dawn * High CVE-2024-7255: Out of bounds read in WebTransport * High CVE-2024-7256: Insufficient data validation in Dawn ---- update to 127.0.6533.72 * CVE-2024-6988: Use after free in Downloads * CVE-2024-6989: Use after free in Loader * CVE-2024-6991: Use after free in Dawn * CVE-2024-6992: Out of bounds memory access in ANGLE * CVE-2024-6993: Inappropriate implementation in Canvas * CVE-2024-6994: Heap buffer overflow in Layout * CVE-... •
CVSS: 7.8EPSS: 0%CPEs: 3EXPL: 0CVE-2024-6993 – Debian Security Advisory 5735-1
https://notcve.org/view.php?id=CVE-2024-6993
01 Aug 2024 — update to 127.0.6533.88 * Critical CVE-2024-6990: Uninitialized Use in Dawn * High CVE-2024-7255: Out of bounds read in WebTransport * High CVE-2024-7256: Insufficient data validation in Dawn ---- update to 127.0.6533.72 * CVE-2024-6988: Use after free in Downloads * CVE-2024-6989: Use after free in Loader * CVE-2024-6991: Use after free in Dawn * CVE-2024-6992: Out of bounds memory access in ANGLE * CVE-2024-6993: Inappropriate implementation in Canvas * CVE-2024-6994: Heap buffer overflow in Layout * CVE-... •
CVSS: 5.3EPSS: 0%CPEs: 20EXPL: 0CVE-2024-40794 – Apple Security Advisory 07-29-2024-1
https://notcve.org/view.php?id=CVE-2024-40794
29 Jul 2024 — This issue was addressed through improved state management. This issue is fixed in macOS Sonoma 14.6, iOS 17.6 and iPadOS 17.6, Safari 17.6. Private Browsing tabs may be accessed without authentication. The WebKitGTK web engine suffers from multiple vulnerabilities. An anonymous researcher discovered that processing maliciously crafted web content may lead to an unexpected process crash. • https://support.apple.com/en-us/HT214121 • CWE-287: Improper Authentication •
CVSS: 9.8EPSS: 3%CPEs: 42EXPL: 0CVE-2024-40782 – webkitgtk: webkit2gtk: Use-after-free was addressed with improved memory management
https://notcve.org/view.php?id=CVE-2024-40782
29 Jul 2024 — A use-after-free issue was addressed with improved memory management. This issue is fixed in iOS 16.7.9 and iPadOS 16.7.9, Safari 17.6, iOS 17.6 and iPadOS 17.6, watchOS 10.6, tvOS 17.6, visionOS 1.3, macOS Sonoma 14.6. Processing maliciously crafted web content may lead to an unexpected process crash. A flaw was found in WebKitGTK. Processing malicious web content can trigger a use-after-free issue due to improper bounds checking, causing an unexpected process crash, resulting in a denial of service. • https://support.apple.com/en-us/HT214121 • CWE-416: Use After Free •
CVSS: 6.5EPSS: 2%CPEs: 32EXPL: 0CVE-2024-40776 – webkitgtk: webkit2gtk: Use after free may lead to Remote Code Execution
https://notcve.org/view.php?id=CVE-2024-40776
29 Jul 2024 — A use-after-free issue was addressed with improved memory management. This issue is fixed in iOS 16.7.9 and iPadOS 16.7.9, Safari 17.6, iOS 17.6 and iPadOS 17.6, watchOS 10.6, tvOS 17.6, visionOS 1.3, macOS Sonoma 14.6. Processing maliciously crafted web content may lead to an unexpected process crash. A vulnerability was found in WebKitGTK. A use-after-free may lead to Remote Code Execution. • https://support.apple.com/en-us/HT214121 • CWE-416: Use After Free •
CVSS: 7.8EPSS: 1%CPEs: 31EXPL: 0CVE-2024-40789 – Apple WebKit WebCodecs VideoFrame Out-Of-Bounds Read Information Disclosure Vulnerability
https://notcve.org/view.php?id=CVE-2024-40789
29 Jul 2024 — An out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in iOS 16.7.9 and iPadOS 16.7.9, Safari 17.6, iOS 17.6 and iPadOS 17.6, watchOS 10.6, tvOS 17.6, visionOS 1.3, macOS Sonoma 14.6. Processing maliciously crafted web content may lead to an unexpected process crash. A flaw was found in WebKitGTK. Processing malicious web content can trigger an out-of-bounds read due to improper bounds checking, causing an unexpected process crash, resulting in a denial of service. • https://support.apple.com/en-us/HT214121 • CWE-125: Out-of-bounds Read •