All CVEs — page 1082 of 1220
The complete archive, 25 per page, newest first. 30483 records. Search instead.
A stored cross-site scripting (XSS) vulnerability in phpMyFAQ versions prior to 4.2.0-alpha allows unauthenticated users to inject JavaScript that can be executed in an administrator's browser, leading to potential admin account takeover.
The flaw allows a remote attacker to execute arbitrary code through the open() functions, posing a significant security risk.
A remote code execution vulnerability exists in geelen mcp-remote versions 0.1.16 through 0.1.38, allowing attackers to execute arbitrary code via specific functions.
The geelen mcp-remote library has a sensitive information disclosure vulnerability in its authorization server metadata and utility components, allowing remote attackers to access confidential data without authentication. This affects versions 0.1.32 through 0.1.38.
The flaw allows an attacker to forge server-side requests, potentially leading to unauthorized access to internal resources via the WWW-Authenticate header.
This flaw is an out-of-bounds write vulnerability in Altera Trusted Firmware, which can be exploited to bypass memory protections and potentially gain unauthorized access or control.
A buffer size calculation flaw in Altera Trusted Firmware on HPS can lead to overflow conditions, potentially allowing attackers to execute arbitrary code.
A stack-based buffer overflow vulnerability exists in Altera Trusted Firmware on HPS, allowing for potential exploitation due to improperly configured or implemented memory protections.
HFS2 version 2.4.0 and earlier allows unauthenticated attackers to read, write, append, and delete files, posing a significant risk to the confidentiality, integrity, and availability of the host.
HFS2 version 2.4.0 and earlier is vulnerable to remote code execution via a template injection flaw in the multipart upload handler, allowing unauthenticated attackers to execute arbitrary commands on the host system.
The flaw in DCMTK allows attackers to exploit a heap over-read vulnerability by crafting DICOM instances with more frames than the buffer contains, potentially leading to application crashes or memory leaks.
The redis-parser library fails to validate RESP protocol multi-bulk length values, allowing attackers to trigger uncaught RangeErrors with excessively large declared lengths. This vulnerability can crash Node.js client processes when a malicious Redis endpoint delivers crafted RESP headers with lengths exceeding 2^32-1.
The flaw allows an attacker to inject arbitrary shell commands during the processing of an untrusted source RPM, leading to potential arbitrary command execution as the invoking user.
The flaw in rpm allows an attacker to execute arbitrary code by supplying a crafted manifest file, leading to a full compromise of the affected system.