All CVEs — page 266 of 631
The complete archive, 25 per page, newest first. 15775 records. Search instead.
The flaw allows an authenticated attacker to bypass TechDocs sanitization and execute arbitrary code by manipulating the markdown_extensions configuration.
A configuration bypass vulnerability in Backstage's TechDocs package allows authenticated users to execute arbitrary commands during documentation builds by manipulating MkDocs configuration files. This represents a significant security risk as it can lead to remote code execution in the build environment.
A remote code execution vulnerability exists in Backstage's TechDocs plugin where authenticated users can inject malicious markdown extensions into mkdocs.yml files, allowing arbitrary OS command execution on the build host. This affects developers who can register catalog entities and is particularly dangerous because it can be exploited from outside the organization's network.
The firmware of Fanvil x7a version 2.6.0.1182 lacks cross-origin resource protection, enabling Cross-Site Request Forgery (CSRF) attacks.
The flaw allows unauthenticated attackers to inject commands and execute code on the underlying Android operating system, due to insecure user input handling in the diagnostic ping tool.
The flaw allows unauthenticated attackers to inject commands and execute code on the underlying Android operating system, leading to remote code execution.
The flaw allows Cross-Site Request Forgery Attacks due to the lack of cross-origin resource protection in the Fanvil x7a firmware version 2.6.0.1182, enabling unauthorized state-changing requests.
The websocket handler in Fanvil x7a firmware version 2.6.0.1182 lacks proper authentication, allowing unauthorized access to device resources such as operational logs and diagnostic requests.
A heap buffer overflow in NTFS-3G's ntfs_ib_copy_tail() function allows attackers to corrupt heap memory when processing malicious NTFS images, potentially leading to privilege escalation through the SUID-root binary.