All CVEs — page 387 of 631
The complete archive, 25 per page, newest first. 15775 records. Search instead.
This flaw allows for PHP object injection, which can lead to arbitrary code execution. It matters because attackers can exploit it to gain control over the system.
This flaw allows unauthenticated attackers to inject SQL commands, potentially leading to data theft or manipulation.
WSS4J streaming code has a flaw where signature references using WS-Security STR-Transform leave an internal flag permanently set, causing the policy enforcer to skip checking subsequent signed elements even when they should be validated. This allows attackers to bypass SOAP Body signing requirements and enables XML Signature Wrapping attacks without detection.
The flaw in WSS4J allows an attacker to confuse the EncryptedHeader, promoting an attacker-controlled plaintext element as the decrypted header, leading to potential policy bypass and loss of confidentiality.
The flaw is an authentication bypass vulnerability in the API session-based authentication management of Cisco Catalyst SD-WAN Manager, allowing unauthenticated attackers to gain admin-level access. This matters because it significantly compromises the security of the system, enabling unauthorized access to critical functionalities.
This flaw allows an attacker to inject malicious SQL commands, potentially leading to data theft or manipulation through the WP Activity Log feature in versions 5.6.6 and below.