All CVEs — page 353 of 631
The complete archive, 25 per page, newest first. 15775 records. Search instead.
The flaw in Mooncake transfer engine before 0.3.13 allows unauthenticated attackers to read and write arbitrary process memory, potentially disclosing sensitive information or leading to code execution.
The Mooncake transfer engine has a memory exhaustion vulnerability that allows unauthenticated attackers to continuously send notify frames up to 1 MB each, causing unlimited memory growth until the system's OOM killer terminates the process. This creates a denial-of-service condition that can be exploited without any authentication or user interaction.
The flaw allows unauthenticated attackers to exhaust the server's worker thread pool by sending specially crafted LDAP operations that cause the server to switch between threads before completing responses, leading to a denial of service for all clients.
RAGFlow 0.24.0 allows attackers to execute arbitrary code due to improper access control, which can lead to full system compromise.
The flaw allows an attacker to bypass access controls by manipulating trace_mindmap, potentially leading to unauthorized data access.
The langflow AI application has a directory traversal vulnerability in its knowledge base creation endpoint that allows attackers to write files outside the intended workspace, potentially leading to arbitrary file overwrites or writes.
The flaw allows an authenticated attacker to execute arbitrary Python code on the server, leading to remote code execution.
The flaw allows path traversal, enabling attackers to write files to arbitrary locations on the server, bypassing intended restrictions.
The vulnerability allows an attacker to traverse directories and write content to arbitrary locations, potentially leading to unauthorized data access or modification.
This flaw allows an attacker to write files to arbitrary locations outside the intended directory, potentially leading to unauthorized data manipulation or system compromise.
The flaw allows remote code execution via the live tutorbot WebSocket interface, enabling attackers to inject and execute arbitrary shell commands.
The flaw allows a remote attacker to traverse paths and potentially write or edit files outside the intended workspace, leading to data loss or corruption.