All CVEs — page 456 of 631
The complete archive, 25 per page, newest first. 15775 records. Search instead.
The flaw is a use-after-free vulnerability in QEMU's 9pfs subsystem, allowing a malicious guest user to escape the shared directory boundary and perform arbitrary file read/write and code execution.
A cross-site scripting (XSS) vulnerability allows unauthenticated attackers to inject malicious content into a COUNTER message's RFC From address, leading to potential access to victim's mailbox data.
This flaw allows unauthenticated attackers to perform path-traversal writes and execute commands as zimbra by abusing unsigned save fields in supported public Briefcase documents.
This vulnerability allows unauthenticated attackers to forge a share notification, leading to stored Cross-Site Scripting (XSS) and potential access to the victim's mailbox data.
This flaw allows unauthenticated attackers to forge a share notification, leading to stored cross-site scripting (XSS) when a signed-in user clicks on it, granting the attacker access to the victim's mailbox data.
The vulnerability allows an authenticated attacker to inject arbitrary commands via a crafted GIM bundle, leading to potential arbitrary command execution with elevated privileges.
IBM Guardium Data Protection 12.2 contains a path traversal vulnerability that allows remote attackers to access restricted directories, potentially leading to sensitive data exposure, file deletion, or arbitrary code execution.
IBM Guardium Data Protection 12.2 contains a SQL injection vulnerability in its PESI service that allows authenticated attackers to access sensitive internal database information. This represents a significant data exposure risk as the service handles critical data protection functions.
IBM Guardium Data Protection stores REST service-account passwords in a reversible plaintext format, allowing authenticated attackers to recover these credentials and gain administrative REST access tokens. This represents a privilege escalation vulnerability where stolen credentials can be used to fully compromise the system.