All CVEs — page 280 of 631
The complete archive, 25 per page, newest first. 15775 records. Search instead.
A flaw in the SSO login flow allows attackers to redirect authentication responses to attacker-controlled URLs instead of CloudVision, potentially enabling unauthorized access to user accounts. This represents a significant risk to identity provider security.
A Gitea instance configured with ALLOWED_DOMAINS for migrations can be tricked into migrating to internal services by using DNS hijacking to point allowed hostnames to loopback or private IP addresses, bypassing local network restrictions. This allows attackers to access internal services that should normally be unreachable from the external migration endpoint.
A Server-Side Request Forgery (SSRF) vulnerability in GitHub Enterprise Server allows authenticated repository contributors to make the server issue requests to internal hosts, potentially leading to remote code execution. This affects GCP service account credential validation and requires specific configuration with Advanced Security enabled.
Dell System Update has a privilege escalation vulnerability where low-privileged local users can gain higher privileges. This allows attackers to elevate their access level within the system.
Dell System Update has a permission assignment flaw that allows low-privileged local users to gain elevated privileges. This creates a path for attackers to move from a standard user account to system-level access.
The flaw is a Path Traversal vulnerability in Dell System Update versions prior to 2.3.0.0, allowing unauthenticated attackers to gain filesystem access and potentially execute arbitrary code with root privileges.
Dell System Update's improper certificate validation allows attackers with remote access and high privileges to potentially execute arbitrary code on affected systems. This vulnerability undermines the security of system updates by accepting invalid certificates, creating a potential backdoor for malicious actors.
The flaw is a use-after-free vulnerability in BluetoothCccHandlerCallbackImpl, which can lead to remote code execution. This matters because it allows attackers to exploit the issue without additional privileges, making it a critical security risk.
The vulnerability allows any account with the Proposer role to perform explicitly barred actions, draining the contract's balance in two transactions with zero signatures.
The flaw allows attackers to execute arbitrary code via PostScript files when Ghostscript is installed, due to improper handling of EPS and PostScript formats in WeasyPrint.