All CVEs — page 355 of 631
The complete archive, 25 per page, newest first. 15775 records. Search instead.
The flaw allows a remote attacker to perform a cross-site request forgery (CSRF) attack, leading to remote code execution by exploiting the update form in GetSimple CMS CE versions prior to 1.5.
The GetSimple CMS update handler is vulnerable to Server-Side Request Forgery (SSRF) due to insufficient validation of user-supplied URLs. An attacker can make the server fetch content from arbitrary destinations including internal services and cloud metadata endpoints, potentially leading to information disclosure.
The flaw allows an attacker to execute arbitrary code by processing a malicious ZIP archive, leading to remote code execution (RCE) as the web-server user.
The flaw allows an attacker to inject arbitrary HTML and JavaScript into Sakai Conversations, leading to cross-site scripting (XSS) attacks.
The flaw allows an attacker to exploit the password reset endpoint to gain unauthorized access to the administrator account by generating and testing possible password candidates.
This vulnerability allows an unauthenticated attacker to write arbitrary files on the system by exploiting path traversal in FortiMail versions 8.0.0 to 8.0.1, 7.6.0 to 7.6.6, 7.4.0 to 7.4.8, and 7.2.0 to 7.2.9, enabling unauthorized code execution.
This flaw allows a database user to write data out-of-bounds in the IVFFlat index build process, potentially leading to arbitrary code execution. This is significant because it can enable attackers to gain full control over the database system.
The Joyland AI app allows attackers with shared network access to inject JavaScript, potentially leading to unauthorized access to sensitive data and device resources.