All CVEs — page 247 of 631
The complete archive, 25 per page, newest first. 15775 records. Search instead.
A URL path normalization inconsistency in Malcolm's nginx reverse proxy allows authenticated users to bypass role-based access controls by crafting specially formatted request paths. This creates a path traversal-like vulnerability where users can access administrative endpoints they shouldn't have permission to reach.
JHipster applications can store and serve attacker-controlled Blob data with malicious content types that execute in the context of the application origin when opened by privileged users. This allows authenticated users to potentially execute arbitrary code or perform cross-site scripting attacks.
The msgpack5 library has a buffer over-read vulnerability where it reads a map32 header's length before validating the complete header is available, leading to unexpected RangeError exceptions instead of proper IncompleteBufferError handling. This can cause application crashes or unexpected termination when processing malformed data.
GnuTLS v3.8.13 contains a hostname verification bypass flaw that allows attackers to skip certificate validation checks and eavesdrop on encrypted communications. This vulnerability specifically affects the Common Name fallback mechanism, making it possible for attackers to use crafted certificates to impersonate legitimate servers.
A path traversal vulnerability in Bower's decompress-zip library allows attackers to write files outside the intended extraction directory by crafting malicious ZIP archives with prefix-sibling directory paths. This can lead to arbitrary file overwrites and potential remote code execution.
The msgpack5 library has a recursive streaming decoder that can be exhausted by sending many small valid MessagePack values in a single chunk, leading to JavaScript call stack overflow and process interruption. This affects applications using the library for message processing.
Pydantic AI allows remote code execution through missing content-type validation in web endpoints, enabling attackers to execute tools with local process privileges when developers visit malicious websites.