All CVEs — page 260 of 631
The complete archive, 25 per page, newest first. 15775 records. Search instead.
This flaw involves improper control of a resource through its lifetime, potentially allowing unauthorized access or manipulation. It matters because it could lead to significant data breaches or system compromises.
This vulnerability allows unauthenticated users to execute arbitrary commands on the affected Splunk Enterprise server via the Patroni REST API, posing a significant risk to system security.
A local user with command execution privileges on a Splunk Enterprise system can manipulate upgrade scripts to execute arbitrary commands as root during package upgrades. This allows privilege escalation from the Splunk user to root through trusted installation content during upgrade operations.
An authenticated user in Amazon Athena could read metadata from other AWS accounts, including account identifiers and SQL statements, without proper authorization checks. This allows for cross-account information leakage that could aid further attacks.
The AsyncHttpClient library has an unbounded WebSocket decompression vulnerability where malicious peers can send small compressed messages that expand to huge Netty buffers, exhausting JVM heap memory. This affects versions 2.2.0 through 3.0.14.