All CVEs — page 1115 of 1220
The complete archive, 25 per page, newest first. 30483 records. Search instead.
The flaw lies in Postiz's use of `Math.random()` for generating security-sensitive credentials, which is not cryptographically secure. Attackers can exploit this to reconstruct the PRNG state and derive past and future credentials, compromising user and organization security.
The flaw allows unauthenticated attackers to include local PHP files, leading to remote code execution (RCE). This is significant because it bypasses authentication and can compromise the entire system.
The flaw allows organization members without Git provider access to retrieve plaintext provider credentials, potentially leading to unauthorized access to private repositories or manipulation of external workflows.
The LightRAG login endpoint lacks rate limiting, allowing attackers to perform brute-force password guessing attacks, which can lead to unauthorized access to sensitive documents and administrative operations.
The flaw allows a low-privileged user to execute arbitrary code as root by manipulating a UNIX socket, leading to a Remote Code Execution (RCE) vulnerability.
Netdata's WebSocket server allows unauthenticated clients to negotiate compression before authentication, enabling attackers to perform memory exhaustion attacks through specially crafted compressed data frames that can cause large server-side allocations and eventual service termination.