All CVEs — page 11 of 1220
The complete archive, 25 per page, newest first. 30483 records. Search instead.
Adobe Experience Manager contains a code injection vulnerability (CWE-94) allowing low-privileged attackers to execute arbitrary code in the context of the current user due to improper control of code generation. The vulnerability is exploitable remotely without user interaction and has a changed scope, increasing its severity to CVSS 9.9.
Adobe Experience Manager contains a code injection vulnerability (CWE-94) allowing low-privileged attackers to execute arbitrary code in the context of the current user due to improper control of code generation. The vulnerability is exploitable remotely without user interaction and has a changed scope, increasing its severity.
A flaw in Active Storage's ImageMagick integration (CWE-1188) allows unauthenticated attackers to trigger arbitrary file read/write operations by uploading a specially crafted image that exploits ImageMagick's coder selection behavior. This occurs because Active Storage does not restrict which ImageMagick coders are invoked during analysis, enabling attackers to leverage coders that operate on embedded filenames rather than the image itself.