All CVEs — page 273 of 631
The complete archive, 25 per page, newest first. 15775 records. Search instead.
NVIDIA Model-Optimizer suffers from a deserialization vulnerability that allows attackers to execute arbitrary code by tricking the application into processing untrusted data. This flaw can lead to full system compromise and data exposure.
A vulnerability in Backstage's techdocs package allows authenticated users to execute arbitrary code during documentation builds by manipulating mkdocs theme configuration. This is particularly dangerous because it can be exploited through repository write access, potentially leading to full system compromise.
A vulnerability in Backstage's TechDocs backend allows authenticated users to bypass configuration sanitization and execute arbitrary code on the documentation generation host. This represents a significant security risk as it enables remote code execution in the backend environment.
An authenticated user can bypass authorization controls on Scaffolder templates in Backstage, potentially gaining unauthorized access to source control resources. This vulnerability allows attackers to execute restricted scaffolder actions they shouldn't be able to perform.
The flaw allows an authenticated user to expose sensitive internal execution data from another user's Scaffolder task, potentially leading to unauthorized changes in external services.
The Backstage scaffolder backend has a flaw in task state validation that allows authenticated users to potentially access and modify backend application files under specific conditions. This could lead to compromise of confidentiality, integrity, and availability of the backend system.
An authenticated Backstage user can craft catalog entities with placeholder directives that reference resources outside the entity's source repository, potentially exposing unintended data to users who should not have access to it.
A collaborator with write access to repository code can accidentally delete published releases by using the tag deletion endpoint, even without release deletion permissions. This bypasses protection rules that should have prevented deletion of release tags.