All CVEs — page 330 of 631
The complete archive, 25 per page, newest first. 15775 records. Search instead.
Mammoth.js is vulnerable to a regular expression denial of service (ReDoS) attack that can block the Node.js event loop when processing crafted .docx files with unterminated quoted strings containing repeated backslash escapes in style maps, potentially causing a denial of service for all users of the application.
This vulnerability allows users with upload permissions to inject malicious scripts via a video trailer URL, leading to potential JavaScript execution in victims' browsers.
This vulnerability allows authenticated uploaders to inject HTML by submitting doubly-encoded entities in video titles, leading to potential cross-site scripting attacks.
The flaw allows unauthenticated attackers to bypass authentication by pre-creating an account using forged external identity fields, posing a significant security risk.
The flaw allows users of a deactivated organization to still sign in and create sessions, potentially leading to unauthorized access.
ZITADEL's authentication system allows attackers to bypass primary factor verification by enrolling authenticators on identify-only login sessions, enabling unauthorized access using only a victim's username. This vulnerability affects both Login V1 and Login V2 UIs.
This vulnerability allows unauthenticated attackers to bypass authentication by obtaining OTP codes, potentially taking over accounts and gaining MFA-authenticated sessions, including administrator access.
The flaw allows attackers to enroll second-factor authentication methods without proper primary factor verification, posing a significant risk to user accounts.
This vulnerability allows attackers with user-write permission in one organization to obtain an enrollment code for a user in another organization, potentially leading to account takeover.
ZITADEL's IdP intent tokens are encrypted with unauthenticated encryption that allows users to tamper with their own tokens to impersonate other users during external login flows. This creates a session hijacking vulnerability where attackers can steal tokens or hijack sessions by predicting timing races.
This flaw allows unauthenticated attackers to bind their external identity provider accounts to victims' ZITADEL accounts, enabling them to impersonate victims. This is critical as it bypasses authentication and authorization controls.