All CVEs — page 1104 of 1220
The complete archive, 25 per page, newest first. 30483 records. Search instead.
This flaw allows users with the Subscriber role and above to obtain a valid identity assertion for another user, including administrators, and authenticate as them, due to the plugin not binding the OpenID Connect identity assertion to the correct authorization grant.
The flaw allows unauthenticated attackers to write arbitrary PHP files on the server, leading to Remote Code Execution (RCE) when the caching feature is enabled.
An attacker can manipulate file paths to access files outside of the intended directory structure, potentially leading to unauthorized data access or system compromise. This path traversal vulnerability allows bypassing directory restrictions that should limit file access.
The divi-dash WordPress plugin before 1.0.7 fails to validate the client IP address used for rate limiting and banning, allowing attackers to spoof IP addresses and bypass these features, leading to potential denial of service.
The flaw allows unauthenticated users to extract arbitrary data, including password hashes, by injecting a payment token into a SQL statement without proper sanitization.
The flaw is a stack-based buffer overflow in the copy_msg_element function of the Device Discovery Service in Fast FAC1203R Gigabit Edition 2.0.4, which can lead to remote code execution. This issue is critical as it allows attackers to exploit the vulnerability to gain control over the affected system.