All CVEs — page 319 of 631
The complete archive, 25 per page, newest first. 15775 records. Search instead.
This vulnerability allows local privilege escalation on Android devices due to a permission bypass flaw in Google's implementation. An attacker with local access can gain elevated privileges without needing additional execution privileges or user interaction.
A vulnerability in Ghost's image processing library allowed staff users to execute arbitrary commands by creating a bookmark card for an attacker-controlled website.
The flaw lies in the default SECRET_KEY and LIVE_SERVER_SECRET_KEY values in Plane project management tool versions prior to 1.4.0, allowing attackers to forge signed values and bypass authentication.
The flaw allows an attacker to log into a victim's Plane account by setting an unverified OAuth email to the victim's address, bypassing the need for the victim's password.
The flaw allows an unauthenticated attacker to register an account with a target's email, enumerate pending invitations, and join a workspace as the target, compromising the target's account and workspace.
The flaw in Plane's magic-code email login allows for brute-force attacks due to the lack of rate limiting and failed-attempt tracking, leading to potential unauthorized access.
The flaw allows a workspace Guest to hijack assets from another project by manipulating asset UUIDs, effectively reassigning ownership and providing a presigned download URL for the hijacked file.
The flaw allows an attacker to exploit a webhook to fetch internal resources by registering a malicious URL that redirects to an internal address, leading to potential data exfiltration.
This vulnerability allows any project member, including a guest, to demote other members to a lower role, potentially denying them project control. This is significant because it can lead to unauthorized access and control over project resources.
This flaw involves a race condition in Apache Struts where concurrent execution using shared resources without proper synchronization can lead to localized message formatting issues, potentially exposing user data or causing server errors.
Apache Struts suffers from an asymmetric resource consumption vulnerability where requests bound to BigDecimal properties can generate responses orders of magnitude larger than the original request, allowing attackers to exhaust server resources with minimal traffic. This affects versions from 2.5.14 through 2.5.33, 6.0.0 through 6.11.0, and 7.0.0 through 7.3.0.
This vulnerability allows an attacker to inject malicious OGNL expressions, potentially leading to remote code execution. It matters because it can be exploited to gain full control over the affected application.
This vulnerability allows for Blind SQL Injection in WP BASE Booking, enabling attackers to extract data from the database without direct error messages.
The Five Star Restaurant Reservations system has a flaw where sensitive data gets embedded into sent data during reservation processing, potentially exposing confidential information to unauthorized parties. This vulnerability allows attackers to retrieve embedded sensitive data through the reservation system.