All CVEs — page 398 of 631
The complete archive, 25 per page, newest first. 15775 records. Search instead.
A buffer overflow vulnerability in HPE Networking Instant ON allows unauthenticated remote attackers to execute arbitrary code as a privileged user, posing a critical risk.
The flaw is a login cross-site request forgery (CSRF) issue in the static credentials callback, allowing attackers to forge requests and gain unauthorized access. This matters because it can lead to unauthorized account takeovers and data breaches.
A Ruby application using the crmne/ruby_llm library is vulnerable to a regular expression denial-of-service attack that can cause excessive CPU consumption when processing chat responses with many unterminated tags. This allows an attacker to delay processing and potentially exhaust system resources.
This vulnerability allows any user with a pending team invitation to invite additional attacker-controlled accounts with elevated privileges, leading to unauthorized access and potential data manipulation.
The flaw allows unauthenticated attackers to bypass authentication in Dockhand's git webhook endpoints, enabling arbitrary stack redeployments and potentially leading to full host compromise.
This flaw allows a remote attacker to execute arbitrary code through the index.php endpoint, posing a critical risk due to the high privilege level of the vulnerability.
This flaw allows attackers to bypass CORS restrictions by crafting malicious web pages that can invoke browser automation tools, leading to potential script execution and data exfiltration.
This flaw allows attackers to bypass authorization by misusing HTTP session headers, enabling them to access data from different tenant namespaces and databases.
VLC media player before 3.0.24 allows attackers to exploit a path traversal vulnerability to write arbitrary files with user privileges, potentially leading to code execution via Lua script injection.
This flaw involves a buffer overflow in ANGLE in Google Chrome on Android prior to 154.0.8037.92, allowing remote attackers to execute arbitrary code outside the sandbox via a crafted HTML page.
A type confusion vulnerability in V8 of Google Chrome prior to 154.0.8037.92 could allow a remote attacker to execute arbitrary code within the sandbox by tricking a user into visiting a crafted HTML page.
A WebView authorization flaw in Google Chrome for Android allows remote attackers to execute arbitrary code outside the sandbox after compromising the renderer process, potentially leading to full system compromise.
A type confusion vulnerability in V8 of Google Chrome prior to 154.0.8037.92 could allow a remote attacker to execute arbitrary code within the sandbox by tricking a user into visiting a crafted HTML page.
The flaw is a use-after-free vulnerability in the PictureInPicture feature of Google Chrome prior to version 154.0.8037.92, which could allow a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page.
A type confusion vulnerability in V8 of Google Chrome prior to 154.0.8037.92 could allow a remote attacker to execute arbitrary code within the sandbox by tricking a user into visiting a crafted HTML page.
A type confusion vulnerability in V8 of Google Chrome prior to 154.0.8037.92 could allow a remote attacker to execute arbitrary code within the sandbox via a specially crafted HTML page.