All CVEs — page 1110 of 1220
The complete archive, 25 per page, newest first. 30483 records. Search instead.
The flaw is a synchronous exception handling issue in request-filtering-agent where literal private IP addresses trigger uncaught exceptions instead of asynchronous error delivery, potentially crashing Node.js applications. This affects applications using RequestFilteringHttpAgent or RequestFilteringHttpsAgent when connecting to private IPs like 127.0.0.1 or 169.254.169.254.
MPXJ library is vulnerable to XML External Entity (XXE) processing when reading Merlin project files, allowing attackers to read arbitrary local files through crafted database inputs. This affects versions 5.5.5 through 16.4.1.
The psd-tools Python package had a memory allocation vulnerability where attacker-controlled PSD files could trigger massive memory allocations before validating file data, potentially causing out-of-memory crashes in services processing untrusted PSD files.
The flaw allows attackers to cause excessive memory allocation by sending SIP messages with oversized Content-Length headers before enforcing maximum message length limits. This leads to denial of service as the system allocates more memory than intended.
The flaw in LTSecurity LTK3500SF involves hard-coded weak credentials, allowing dictionary-based cracking tools to recover root and guest account passwords, which can then be used to gain root-level access via Telnet and SSH services.
The flaw allows unauthenticated remote code execution due to deserialization of untrusted data, posing a significant security risk.
The flaw allows unauthenticated remote code execution due to insufficient integrity checks, making it a critical vulnerability that can be exploited to gain full control over the system.
A buffer overflow vulnerability in UniFi gateway devices allows remote attackers to write data beyond the allocated memory bounds, potentially leading to a denial of service condition that can make the device unavailable to legitimate users.
An Uncontrolled Recursion vulnerability in UniFi gateway devices allows remote attackers to trigger a Denial of Service condition by sending specially crafted network packets that cause infinite recursive calls, exhausting system resources and rendering the device unavailable.
Crypt::SelfCertificate versions from 1.01 through 1.05 for Perl contain malware that executes Python code from an obfuscated URL, allowing arbitrary code execution.
The flaw allows attackers to inject malicious scripts into article content, which can be executed in the context of the victim's browser, leading to potential data exfiltration or manipulation.
The flaw is a SQL injection vulnerability in the PageAction.verify endpoint of MCMS 6.1.1 through 6.2.1, allowing attackers to execute arbitrary SQL commands and potentially gain full control over the database.
The vulnerability allows an out-of-bounds write that could lead to arbitrary code execution, posing a significant risk to users opening malicious files.
The vulnerability allows for a stack-based buffer overflow, enabling arbitrary code execution when a user opens a malicious file. This can lead to significant security risks.
The flaw is a Server-Side Request Forgery (SSRF) vulnerability in Adobe Experience Manager Forms JEE that allows a low-privileged attacker to gain elevated access to internal resources, potentially leading to privilege escalation.
The flaw is a Server-Side Request Forgery (SSRF) vulnerability in Adobe Experience Manager Forms JEE that could allow attackers with high privileges to gain elevated access to internal resources. This matters because it can lead to unauthorized access and data exposure.
The vulnerability allows an out-of-bounds write that could result in arbitrary code execution, posing a significant risk to users.
The flaw is an Improper Input Validation vulnerability in Adobe Experience Manager Forms JEE that allows high-privileged attackers to execute arbitrary code. This matters because it can lead to full system compromise without user interaction.