All CVEs — page 1122 of 1220
The complete archive, 25 per page, newest first. 30483 records. Search instead.
The VeloCloud Orchestrator (VCO) on-premises version has a critical vulnerability that allows remote attackers to access privileged internal functionality, compromising the confidentiality, integrity, and availability of the orchestrator and its managed data.
The HUSKY – Products Filter for WooCommerce Professional plugin allows unauthenticated attackers to include and execute arbitrary .php files, leading to code execution and potential data compromise.
The flaw allows authenticated attackers with subscriber-level access or higher to execute arbitrary shortcodes, leading to potential unauthorized actions on the WordPress site.
The flaw allows attackers to supply malformed UTF-8 input to Net::IDN::Punycode's encode_punycode function, causing the Perl module to hang, crash, or return incorrect Punycode labels. This occurs because the module doesn't validate UTF-8 input before processing it, leading to undefined behavior in the XS backend on newer Perls and SIGBUS issues on older ones.
This vulnerability allows attackers to cause CPU exhaustion by exploiting a quadratic time complexity issue in Net::IDN::UTS46's punycode encoding. An attacker can craft malicious domain names that trigger expensive processing during DNS label validation, leading to denial of service.
The flaw allows a truncated label to be decoded incorrectly, leading to a different code point being derived. This can cause a sender to pick a label that resolves to a name on one installation but is rejected on another.
A CPU exhaustion vulnerability exists in Net::IDN::Punycode Perl module versions before 2.590, where decoding long domain labels causes quadratic time complexity due to inefficient buffer insertion operations. This allows attackers to consume excessive CPU resources when processing specially crafted domain names.
The flaw in Net::IDN::Punycode allows attackers to cause a denial of service by sending invalid labels, leading to excessive memory allocation.
The flaw allows heap use-after-free via a decoded code point that reallocates the output buffer, leading to potential memory corruption.
The flaw allows authenticated attackers with Subscriber-level access or higher to delete arbitrary files, potentially leading to remote code execution.