All CVEs — page 356 of 631
The complete archive, 25 per page, newest first. 15775 records. Search instead.
The flaw allows unauthenticated attackers to trigger an unhandled exception, exposing the server environment and .env variables in plaintext.
The vulnerability allows an authenticated admin to read internal services and cloud metadata, including IAM credentials, by exploiting the SSRF guard's handling of IPv6 addresses.
The flaw allows a low-privilege content author to inject JavaScript via event-handler attributes, potentially leading to admin account takeover.
DHIS2 is vulnerable to remote code execution via unsafe Java deserialization, allowing attackers to execute arbitrary code on the server.
Lektor 3.3.14 and 3.4.0b15 are vulnerable to cross-site request forgery, allowing unauthenticated attackers to perform state-changing actions via cross-origin requests without proper CSRF protection.
Podgrab has a race condition vulnerability in its WebSocket handler where multiple goroutines access shared data structures without synchronization, leading to potential crashes and denial of service.
The flaw allows a poisoned discovery response to replace all endpoint values with attacker-controlled values, bypassing security measures and potentially leading to unauthorized access or manipulation of the application.
The flaw allows context-dependent threat actors to manipulate file operations outside the intended directory, potentially leading to arbitrary file creation, overwrite, or truncation.
The Smile parser in FasterXML jackson-dataformats-binary fails to enforce the maxNameLength limit when decoding JSON object property names, allowing unbounded property name lengths that can lead to memory exhaustion and denial of service. This affects binary JSON formats like Smile and CBOR where property names are not validated against configured limits.
The FasterXML jackson-dataformats-binary CBOR parser fails to enforce name length limits when decoding JSON object property names, allowing attackers to craft malicious CBOR documents with unbounded property names that can exhaust memory and cause denial of service.