All CVEs — page 449 of 631
The complete archive, 25 per page, newest first. 15775 records. Search instead.
The AetherBrowser API server exposes an unauthenticated endpoint that allows remote attackers to read email metadata from configured ProtonMail or Gmail accounts without any authentication. This represents a significant data exposure vulnerability where attackers can harvest sensitive email information without needing valid credentials.
A heap-based out-of-bounds write vulnerability in Esri LERC library allows remote attackers to crash applications through crafted raster images, potentially leading to denial of service.
The flaw is a server-side request forgery vulnerability in MediaFlow Proxy versions through 2.4.9, allowing attackers to read full responses from the proxy server by supplying arbitrary internal URLs. This matters because it can lead to unauthorized data access and potential internal network exploitation.
GestSup versions before 3.2.62 are vulnerable to remote code execution due to improper handling of email attachments, allowing unauthenticated attackers to execute arbitrary code by sending emails with specific file extensions.
The vulnerability in pgPointcloud allows authenticated users to read adjacent heap memory, posing a risk of data exfiltration or backend crashes.
The vulnerability allows for argument injection, potentially leading to arbitrary command execution when using a shell runner.
The Ciena Navigator Network Control Suite has an authentication bypass vulnerability in its event-streaming API that allows unauthenticated attackers to access sensitive information streams. This represents a significant information disclosure risk since the API should require authentication but doesn't.