All CVEs — page 1076 of 1220
The complete archive, 25 per page, newest first. 30483 records. Search instead.
The flaw allows an authenticated administrator to execute arbitrary commands via shell interpolation, leading to remote code execution.
The flaw allows a low-privilege user to exfiltrate internal service data and cloud credentials by manipulating the URL query parameter in the /homepage/proxy endpoint.
The flaw allows an authenticated user to upload XML and XSLT files, which can then be executed in the browser, leading to potential data exfiltration and privilege escalation.
A password-authenticated session can obtain a persistent API token before completing a second-factor challenge, allowing access to resources with the victim's permissions.
A user with the customfields.create permission can inject markup into CustomField.name, which is then executed when another user views the asset-list page. This allows for data exposure and potential privilege escalation.
The flaw allows an authenticated organization member to inject shell metacharacters into the repoPath parameter, executing arbitrary commands as root within the Dokploy container. This can lead to full host compromise.
This vulnerability in the Linux kernel's ksmbd module improperly handles access control checks, leading to potential access denial issues and incorrect permission evaluations.
This vulnerability allows an attacker to cause out-of-bounds memory access by supplying a topology blob with section sizes larger than the actual fetched size, potentially leading to kernel crashes or arbitrary code execution.