All CVEs — page 386 of 631
The complete archive, 25 per page, newest first. 15775 records. Search instead.
WSS4J's DER bounds check has an integer overflow that allows oversized memory allocations when processing X.509 certificates with malformed SubjectKeyIdentifier extensions. This can lead to memory exhaustion and denial of service attacks.
The Hostinger Migrator plugin version 1.0 and earlier contains a broken access control vulnerability that allows unauthenticated users to access restricted functionality or data. This flaw enables attackers to bypass authentication mechanisms without needing valid credentials.
The flaw allows for PHP object injection, enabling attackers to execute arbitrary code, leading to potential data breaches and system compromise.
This flaw allows remote attackers to inject PHP objects, leading to potential code execution or data corruption. It matters because it can be exploited to gain unauthorized access or disrupt the system.
This flaw allows for PHP object injection, enabling attackers to execute arbitrary code. It affects versions of Go Live Update Urls up to 7.0.8.
A vulnerability allows unauthenticated attackers to execute arbitrary code via the SMTP Newsletter feature in AcyMailing versions 11.0.5 and earlier, posing a critical risk.
A privilege escalation vulnerability allows authenticated users to import and export customer data with elevated privileges, potentially leading to unauthorized access to sensitive information and system resources.
This flaw allows unauthenticated attackers to inject SQL commands, potentially leading to data theft or corruption.
The NextGEN Gallery plugin allows unauthenticated users to download arbitrary files from the server by manipulating the 'download' parameter in the URL. This vulnerability could allow attackers to access sensitive files like configuration files, database credentials, or source code without needing any authentication.
The flaw allows PHP object injection, enabling attackers to execute arbitrary code. This matters because it can lead to full system compromise.
GravityExport Lite for Gravity Forms allows unauthenticated users to bypass access controls and access restricted functionality, potentially leading to sensitive data exposure. This represents a critical authorization flaw that affects all versions up to 2.7.2.
This flaw allows SQL injection, enabling an attacker to execute arbitrary SQL commands, potentially leading to data theft or corruption.
This flaw allows an attacker to inject malicious SQL code, potentially leading to data theft or manipulation in Quiz Cat versions 3.1.1 and earlier.