All CVEs — page 363 of 631
The complete archive, 25 per page, newest first. 15775 records. Search instead.
The flaw allows attackers to execute untrusted scripts in the context of an admin session via malicious oEmbed content, potentially leading to administrative access compromise.
Ghost CMS versions 2.10.0 through 6.62.9 suffer from a staff enumeration vulnerability that leaks user data without authentication. Attackers can observe API response discrepancies to identify and extract sensitive information about staff members.
A content API vulnerability in Ghost CMS versions 4.0.0 through 6.62.9 allows unauthenticated users to access restricted posts by directly querying the API endpoint. This bypasses the normal authentication and authorization controls that should prevent public access to gated content.
Ghost versions before 6.62.0 allow suspended staff users to reactivate their accounts through self-service password reset, enabling attackers to regain access and privileges.
This vulnerability allows unauthenticated attackers to bypass authentication in Fleet versions before 4.87.0, enabling them to read device data and perform actions such as software installation and MDM migration.
Tornado's CurlAsyncHTTPClient is vulnerable to unbounded memory accumulation when processing gzip-compressed responses, allowing attackers to trigger a denial of service through decompression bombs that consume all available memory.
The vulnerability allows attackers to capture collaborators' session tokens by setting a fallback resolver to an attacker-controlled endpoint, enabling unauthorized credential access.
The flaw allows path traversal, enabling attackers to access unintended resources and potentially steal secrets. This matters because it can lead to unauthorized access to sensitive data and workflows.
The flaw allows path traversal, enabling attackers to access unauthorized data and modify it by leveraging untrusted input in the tableId parameter.
The flaw allows SQL injection, enabling attackers to execute arbitrary DDL or DML commands with the database connection's privileges, potentially leading to data loss or corruption.
The flaw allows attackers to bypass authorization and interpolate sensitive variables in credential test requests, potentially leading to data exfiltration.