All CVEs — page 249 of 631
The complete archive, 25 per page, newest first. 15775 records. Search instead.
IBM DataPower Gateway suffers from a memory allocation flaw during key derivation that can lead to denial of service when exploited by authenticated remote attackers. This vulnerability allows an attacker to cause system unavailability without requiring special privileges or user interaction.
The flaw allows a remote attacker to gain administrative access by exploiting the failure to reject empty passwords during LDAP authentication, which can lead to unauthorized access and control of the IBM DataPower Gateway.
IBM DataPower Gateway suffers from a cryptographic signature verification flaw that allows authenticated attackers to bypass security restrictions, potentially leading to unauthorized access to protected resources.
A heap-based buffer overflow in IBM DataPower Gateway allows remote attackers to cause a denial of service by sending specially crafted input that exceeds allocated buffer boundaries, potentially leading to application crashes or unavailability.
The flaw is a heap-based buffer overflow in IBM DataPower Gateway versions 10.5.0.0 to 10.5.0.22, 10.6.1 to 10.6.6, 10.6.0.0 to 10.6.0.10, and 11.0.0.0 to 11.0.0.2, allowing unauthenticated attackers to execute arbitrary code by overflowing a buffer.
The flaw allows unauthenticated attackers to change account passwords by omitting the reset parameter, potentially taking over administrator accounts.
The flaw allows attackers to inject ImageMagick convert options via uploaded image filenames, leading to remote code execution. This is significant because it enables unauthorized execution of arbitrary code on the server.
The flaw allows authenticated CI users to create arbitrary service account names, potentially leading to credential exposure or privilege escalation through insufficient validation of job configurations. This represents a significant risk in CI/CD environments where service accounts are used for automation.
Pydantic AI's concurrency limiting mechanism fails to properly release capacity slots during streaming requests, leading to resource exhaustion and denial of service when multiple concurrent requests are processed through shared limiters.
EspoCRM before 10.0.5 has an insecure direct object reference vulnerability that allows users with Email Account scope access to retrieve other users' IMAP passwords by knowing a victim's Email Account record ID. This means attackers can steal stored IMAP credentials and gain access to victim mailboxes.