All CVEs — page 295 of 631
The complete archive, 25 per page, newest first. 15775 records. Search instead.
The flaw allows attackers to execute arbitrary executables or scripts as the desktop user by exploiting a validation issue in the run_shell tool of Microsoft UFO's CommandLineExecutor component. This occurs because explorer.exe delegates path arguments to ShellExecute, bypassing shell=False restrictions and enabling privilege escalation through user workflows.
The flaw is an OS command injection vulnerability in the Progress Software Autonomous REST Connector GenAI Agents ARCGenAI-Generator version 2.0, allowing attackers to execute arbitrary commands on a developer's machine via a crafted Swagger/OpenAPI document.
The flaw is an OS command injection vulnerability in SambaBox versions before 5.4.1, allowing attackers to execute arbitrary system commands.
This vulnerability allows guest OS users to perform an out-of-bounds write in the host OS, which could lead to a complete compromise of the host system.
This vulnerability allows unauthenticated attackers to delete disk replicas of objects across all tenants by exploiting missing authorization controls in the EvictDiskReplica and BatchEvictDiskReplica functions. This means attackers can permanently delete critical data without needing any authentication or privileges.
The Mooncake Store application has a critical authentication bypass flaw that allows unauthenticated attackers to completely wipe the cache store by forcing deletion of any objects, potentially causing widespread service disruption and data loss.
The flaw is a missing authentication vulnerability in the Store REST service of Mooncake, allowing unauthenticated attackers to read, inject, or delete objects, and mount attacker-described segments. This vulnerability is critical as it can lead to unauthorized access and manipulation of sensitive data.
The lrzsz library contains an OS command injection vulnerability in its receive utility that allows remote attackers to execute arbitrary commands as the receiving user when processing crafted filenames in pipe mode. This affects systems using lrz with suffixed names like lrztar.
The lrzsz library contains a path traversal vulnerability in its receive utility that allows attackers to write files outside the intended directory using absolute paths. This can lead to arbitrary file overwrite and potentially system compromise.
A heap buffer overflow vulnerability exists in libmikmod's Oktalyzer loader due to integer overflow when processing crafted track counts in OKT modules, potentially allowing remote code execution or crashes.