All CVEs — page 1157 of 1220
The complete archive, 25 per page, newest first. 30483 records. Search instead.
This flaw allows code running inside the sandbox to overwrite the `Symbol.species` property of a host Promise, leading to arbitrary code execution on the host. It matters because it bypasses security measures intended to prevent such attacks.
This vulnerability allows attackers to escape the sandbox and execute arbitrary commands on the host system by exploiting the DANGEROUS_BUILTINS denylist in vm2 NodeVM versions before 3.12.1.
The flaw allows untrusted code to escape a sandbox and execute arbitrary code on the host system by calling non-strict functions with an undefined receiver, leading to Remote Code Execution (RCE).
ArcadeDB versions before 26.9.1 allow authenticated attackers to exploit SSRF vulnerabilities by using IPv6 transition addresses to reach internal services and cloud metadata endpoints.
The flaw allows an authenticated user to bypass access controls by executing SQL queries through LSM index files or the TimeSeries engine, leading to unauthorized data access and manipulation.
The flaw allows an authenticated low-privilege user to bypass security-group type ACL entries for TimeSeries types, leading to unauthorized read or insert access to TimeSeries samples.
A SQL injection vulnerability exists in SiYuan's graph.go query2Stmt function where tag values are directly concatenated into SQL queries without proper escaping, allowing remote attackers to execute arbitrary database queries and access private data across notebooks.