All CVEs — page 1129 of 1220
The complete archive, 25 per page, newest first. 30483 records. Search instead.
The flaw allows unauthorized access to report and label printing functionalities by bypassing permission checks, exposing sensitive data.
The flaw allows any authenticated user to access another user's import session data, exposing sensitive information. This matters because it breaches data privacy despite users being considered trusted within the InvenTree system.
The flaw allows unauthenticated access to plugin settings metadata and non-secret configuration values, posing a risk of sensitive information disclosure.
The flaw allows low-privilege users to enumerate primary keys and disclose sensitive inventory data by exploiting the lack of proper role checks in the InvenTree barcode API endpoint.
The flaw allows an attacker to inject malicious JavaScript into the response, potentially leading to session hijacking and unauthorized actions. It also enables open redirects, which can be used to redirect users to malicious sites.
Dell Command Powershell Provider versions prior to 2.10.2 can be exploited by a low-privileged attacker with local access to insert sensitive information into log files, leading to potential information disclosure.
The flaw allows an unprivileged user to write to kernel memory, potentially leading to privilege escalation or system crashes.
The flaw allows for Cross-Site Scripting (XSS) in the HTML exporter of Telegram Desktop before 6.9.4, which could lead to arbitrary script execution in the victim's browser if they opened a maliciously crafted message.
This vulnerability allows arbitrary command execution on Windows when the envelope address is controlled by an attacker, leading to potential remote code execution as the sending process.
The flaw allows an out-of-bounds write by exploiting a usbredir isochronous OUT stream, potentially leading to arbitrary code execution or data corruption.
Users with edit permissions but without entity ownership can exploit a flaw in Graylog to gain full control over saved searches and dashboards, allowing them to delete or modify content.
The flaw allows an attacker to write or overwrite files with elevated privileges by exploiting improperly validated archive entries, potentially leading to persistent system modification or code execution.
The flaw allows an authenticated user to include shell metacharacters in the ConfigUpdateJob, leading to arbitrary command execution with the privileges of the KubeEdge process.
The flaw allows any authenticated user to restart any machine, even without ADMIN role, by exploiting a misconfigured API endpoint in InvenTree versions prior to 1.4.0.
The flaw allows SSRF attacks by not fully validating server URLs, enabling requests to internal addresses like loopback and cloud metadata.
The flaw allows an authenticated user to read and potentially modify notifiers belonging to other tenants, exposing sensitive credentials and redirecting notifications to attacker-controlled webhooks.
The flaw allows a low-privileged user to overwrite or delete another tenant's maintenance entry, posing a significant risk to data integrity.
The flaw allows any authenticated user to add another account to their group without proper authorization, leading to potential unauthorized access and data exposure.
The flaw allows a user to delete another group's inventory by exploiting the global owner role, leading to data loss.
The flaw in SmallRye Fault Tolerance library causes a memory leak when using ApplyGuard or ApplyFaultTolerance annotations, leading to potential application crashes due to increased memory usage.
The flaw allows any authenticated non-admin user to list and download system-configuration backups, potentially disclosing sensitive information such as password hashes and API tokens.
The flaw allows non-admin users to modify system settings, including threat-intelligence blocklists, potentially leading to unauthorized content access and disruption of monitoring.
The flaw allows any authenticated user to execute arbitrary code as root by manipulating plugin installation and uninstallation tasks, leading to full host compromise.