All CVEs — page 1096 of 1220
The complete archive, 25 per page, newest first. 30483 records. Search instead.
Moquette MQTT broker has a privilege escalation flaw where clients can publish unauthorized Last-Will messages to topics they don't have write permissions for, allowing injection of messages into restricted topics when clients disconnect unexpectedly.
Moquette MQTT broker has a memory exhaustion vulnerability where unbounded message queues can accumulate in memory or storage, allowing remote attackers to cause denial of service by exhausting broker resources.
Moquette MQTT broker suffers from unlimited topic depth recursion that leads to StackOverflowError and service denial when remote clients publish or subscribe with deeply nested topics. This vulnerability allows attackers to disrupt broker sessions and deny service to legitimate clients.
Moquette MQTT broker has a vulnerability in shared subscription handling where malformed topic filters can cause a StringIndexOutOfBoundsException, leading to denial of service for other clients on the same session event loop.
Moquette MQTT broker has a flaw where unhandled exceptions in session processing can terminate shared event loops, causing multiple client sessions to stop processing MQTT commands like PUBLISH and SUBSCRIBE. This affects all clients sharing the same terminated loop, potentially disrupting the entire broker's functionality.
This vulnerability allows an attacker to inject OS commands, leading to arbitrary command execution as the user running the explore command. It matters because it can be exploited to gain full control over the system.
BusyBox TLS implementation contains a heap buffer overflow vulnerability in its Montgomery reduction function due to incorrect buffer allocation size, allowing attackers to trigger memory corruption when processing specially crafted ClientKeyExchange messages without authentication.
The flaw allows a client to substitute their identity into MQTT topic filters, potentially gaining unauthorized access to other tenants' data. This is due to direct substitution of client ID and username values into pattern-based ACL rules.
A vulnerability in PgBouncer allows unauthenticated attackers to cause a denial of service by triggering an integer overflow in packet buffer growth logic, leading to infinite loops that consume CPU resources and stall all client connections.
A missing validation check in PgBouncer's SCRAM authentication parser allows remote attackers to crash the service by sending a malformed client-final-message, causing a NULL pointer dereference that terminates all pooled connections. This vulnerability affects all versions up to 1.25.2 and can be exploited without any valid credentials.
This vulnerability allows an attacker to execute arbitrary code via SQL injection in the Moodle Socialwall plugin versions 3.0 to 3.3, posing a critical risk.
Photoview 2.4.0 contains an SQL injection vulnerability in its album download route that allows unauthenticated attackers to extract arbitrary database data using time-based or blind injection techniques.
The flaw allows server-side template injection, enabling arbitrary Python code execution and OS command execution, posing a significant security risk.