All CVEs — page 1123 of 1220
The complete archive, 25 per page, newest first. 30483 records. Search instead.
The flaw is a heap buffer overflow in the Net::IDN::Punycode Perl module, which can be exploited by attackers to corrupt the heap. This matters because it can lead to arbitrary code execution or other severe impacts.
The flaw allows unauthenticated users to inject malicious code into form submissions, which could then be executed in the browser of an admin user reviewing the submission, leading to potential remote code execution.
The Ninja Forms WordPress plugin has a PHP Object Injection vulnerability when exporting form submissions to CSV, allowing unauthenticated attackers to inject malicious objects that can be executed during deserialization. This creates a high-risk vector for remote code execution if POP chains exist in other plugins or themes.
The Give Tributes plugin for WordPress is vulnerable to PHP Object Injection, allowing unauthenticated attackers to inject a PHP Object if specific conditions are met.
The flaw allows unauthenticated attackers to escalate privileges to Administrator by exploiting a chained vulnerability in the Meta Box AIO plugin for WordPress.
A vulnerability in the Gigatech PDV5701 1.0.31_240305_112640 WebSocket Service allows for missing authentication, enabling remote attackers to exploit it.
The flaw allows SQL injection via manipulation of the operator argument in Yonyou U8cloud 5.x's OpenAPI module, enabling remote code execution.
The flaw is a SQL injection vulnerability in Yonyou KSOA 9.0 due to improper argument handling in search_list.jsp, allowing remote attackers to execute arbitrary SQL commands. This matters because it can lead to data theft or corruption.
Dancer2 web framework allows directory traversal through File route handler that doesn't properly collapse relative path segments, enabling access to files outside the designated public directory. This affects applications using static_handler=0 and explicitly naming File in route_handlers.
Dancer2 framework has a race condition in its hook execution where dying hooks can cause routes to be incorrectly dispatched even after the response has been halted, leading to unexpected behavior and potential data loss. This occurs when exception handlers halt responses but don't prevent cleanup that discards request data, allowing stale routes to execute.
The flaw allows unauthenticated attackers to craft a malicious link that can exfiltrate sensitive information from an authenticated user's session in SAP Fiori Launchpad.
The flaw allows for os command injection through manipulation of the argument command in OctoPrint's Command API, enabling remote code execution.
The vulnerability allows path traversal through manipulation of the filename argument in OctoPrint's File Download API, enabling unauthorized access to files.
The vulnerability allows for cross-site scripting due to improper input handling in the Name argument of the /jobgroup/insert function, enabling remote attackers to inject malicious scripts.