All CVEs — page 337 of 631
The complete archive, 25 per page, newest first. 15775 records. Search instead.
The Mooncake transfer engine has an out-of-bounds read vulnerability in its string parsing function that can be triggered by sending a zero-length handshake frame, allowing unauthenticated attackers to crash the service and potentially disrupt SGLang inference server operations.
This flaw involves an integer underflow in HTTP request body handling in RouterOS, allowing unauthenticated attackers to execute arbitrary code as root or cause a denial of service.
The WebSocket API lacks rate limiting on authentication requests, allowing attackers to perform denial-of-service attacks or brute-force credential guessing with unlimited attempts. This vulnerability exists due to insufficient input validation and control over authentication request frequency.
The flaw allows attackers to impersonate charging stations due to the lack of proper authentication mechanisms, leading to unauthorized access and potential privilege escalation.
The flaw allows the superuser password to be recorded in plain text, posing a significant risk if the server operating system is compromised.
The flaw lies in Armatura One's database initialization routine, which uses a fixed, vendor-defined password for the superuser account. This allows an attacker with server OS access to gain full control over the database.
The flaw lies in the fixed encryption key and initialization vector used by Armatura One, allowing attackers to decrypt sensitive credentials if they have access to the installation package and the encrypted configuration file.
UTMStack contains a server-side request forgery vulnerability in its PDF generation service that allows authenticated attackers to access internal resources by crafting malicious URLs, potentially exposing sensitive backend data in generated PDF reports.