All CVEs — page 313 of 631
The complete archive, 25 per page, newest first. 15775 records. Search instead.
The flaw is an input injection vulnerability in ViewSonic ViewBoard's vCast service, allowing remote, unauthenticated attackers to inject arbitrary data via HTTP requests, potentially leading to remote code execution or data compromise.
A remote attacker can trigger unprivileged APK installation by exploiting an arbitrary file download vulnerability in ViewSonic ViewBoard's vCast APK delivery mechanism. This allows attackers to serve malicious APK files through an unauthenticated download endpoint, potentially leading to unauthorized app installations on affected devices.
The flaw allows an arbitrary website to obtain a permanent API token by exploiting the Web Clipper server, granting full access to Joplin's data.
Scrapy's RefererMiddleware incorrectly interpreted Referrer-Policy header values as Python import paths and attempted to import and execute them as referrer policy classes. This allowed remote attackers to inject arbitrary Python code that could terminate crawlers by calling functions like sys.exit.
The flaw allows a normal workspace member to retrieve plaintext IMAP, SMTP, and CalDAV passwords for other members' connected accounts, enabling unauthorized access to mail and calendars.
The flaw allows an attacker to upload a malicious URL, causing the Dify server to retrieve it, potentially exposing sensitive data and using the server as a network pivot.