All CVEs — page 1090 of 1220
The complete archive, 25 per page, newest first. 30483 records. Search instead.
A flaw in Ansible Automation Platform's automation-controller allows privileged users to inject malicious environment variables that can hijack process execution flows, potentially leading to arbitrary code execution within execution-environment containers. This occurs due to an incomplete validation of environment variable names that omits critical loader variables like BASH_ENV and LD_PRELOAD.
The flaw allows an administrator to read sensitive secrets like the Django secret key and database password by crafting a specific log message format, which can then be forwarded to an external log aggregator.
The flaw allows an attacker to inject JavaScript code into the HTML output, leading to potential full platform takeover.
The flaw in AWX allows an attacker to inject initContainers, serviceAccountName overrides, and projected service account token volumes, leading to privilege escalation and potential exfiltration of namespace secrets.
The flaw allows unauthenticated attackers to open RDP connections without completing the handshake and hold onto connection slots indefinitely, eventually exhausting all available connections and preventing legitimate users from connecting.
A missing authorization check in Loops & Logic plugin versions 4.2.4 and earlier allows unauthenticated users to access restricted administrative functions. This represents a significant security gap that could enable unauthorized access to sensitive data and system controls.
This flaw allows unauthenticated attackers to inject SQL commands, potentially leading to data theft or manipulation.