All CVEs — page 440 of 631
The complete archive, 25 per page, newest first. 15775 records. Search instead.
Budibase versions before 3.45.0 allow authenticated users to read arbitrary local files by embedding file:// references in OpenAPI specifications, potentially exfiltrating sensitive information.
stoatchat before 0.15.5 allows attackers to bypass multi-factor authentication (MFA) by using their own valid MFA ticket with another user's session token, enabling unauthorized access to sensitive operations.
The flaw allows an attacker to determine the existence of local files and potentially cause a denial of service by exploiting the improper resolution of SVG <image href> values as local filesystem paths.
The flaw allows unauthenticated users to inject HTML and JavaScript payloads, which can be executed with the privileges of an authenticated administrator who views the affected data entry.
The Grav CMS Comments plugin fails to authenticate requests to its admin API endpoint, allowing unauthenticated attackers to access comment data including email addresses and server file paths. This represents a significant information disclosure vulnerability that can expose user contact information and system internals.
The flaw allows a user with page-write permission to capture an administrator's session identifier by rendering page content through a Twig sandbox, which can then be replayed by unauthenticated visitors to authenticate as the administrator.
This vulnerability allows an authenticated backend operator to escalate their privileges to full super-admin by manipulating the access map, leading to control over critical system components.
Grav CMS contains web server configuration files with case-sensitive access control rules that can be bypassed by attackers using different case variations of folder names or file extensions, potentially exposing sensitive configuration files and secrets.
Netty's QUIC implementation has a hostname verification flaw where certificates with incorrect hostnames are accepted when using plain X509TrustManager, bypassing critical endpoint identification checks. This allows attackers to impersonate legitimate servers on the network path.
Netty's HTTP/3 codec incorrectly prioritizes the Host header over the request-target authority when converting HTTP/1 requests to HTTP/3, potentially causing routing and authorization decisions to be made based on incorrect authority values. This can lead to virtual-host misrouting, incorrect backend selection, and flawed access control decisions.
Netty's HTTP/3 codec fails to properly handle HTTP/1 CONNECT requests when converting them to HTTP/3 format, allowing attackers to manipulate the tunnel authority and bypass security controls that validate the original CONNECT target. This creates a vulnerability where the HTTP/3 CONNECT request can be crafted with an attacker-controlled authority, potentially enabling unauthorized access through proxies or gateways.
Netty's HTTP/3 codec has a vulnerability where the QPACK encoder-stream instruction decoder doesn't limit string literal lengths, allowing attackers to declare massive values that cause unbounded heap growth through excessive buffer accumulation. This leads to denial of service via OutOfMemoryError.
Netty's HTTP/3 codec has a vulnerability in its QPACK decoder that allows unbounded memory growth and CPU starvation when processing specially crafted continuation bytes. This affects any system using Netty versions 4.2.0.Final through 4.2.17.Final for HTTP/3 connections.
Netty's HTTP/3 codec retains unlimited QPACK encoder state per stream, allowing unbounded heap growth when remote clients fail to send required acknowledgments. This leads to denial of service as server memory fills up.