All CVEs — page 479 of 631
The complete archive, 25 per page, newest first. 15775 records. Search instead.
This vulnerability allows unauthenticated attackers to execute arbitrary files via the web management interface, leading to potential remote code execution.
This vulnerability allows an authenticated user to execute arbitrary commands via the Intermec Fingerprint Command Interface, potentially leading to remote code execution on the Honeywell PD45 Industrial Printer.
This vulnerability allows remote unauthenticated actors to inject malicious instructions into the agent's context, potentially leading to unauthorized modifications of global configurations.
The flaw allows an organization Action author with specific permissions to run JavaScript and load files, potentially disclosing sensitive configuration and secrets.
ZITADEL Login V2 allows session reuse without verifying a user's second factor, potentially enabling unauthorized access.
Wazuh's cluster component suffers from an unbounded memory allocation vulnerability where attackers can trigger massive memory consumption by declaring large payloads in cluster protocol headers without proper validation. This allows for potential denial of service through memory exhaustion.
OpenObserve's unauthenticated /config/runtime endpoint exposes sensitive database connection strings and credentials in plaintext, including PostgreSQL DSNs and usage reporting credentials, allowing attackers to gain access to backend databases and deployment details without authentication.
The zbateson/mail-mime-parser library has an algorithmic complexity vulnerability that allows attackers to cause uncontrolled resource consumption through specially crafted email messages. This vulnerability affects applications parsing untrusted emails and can lead to denial of service by consuming excessive CPU or memory.
Rsdoctor's default report server binds to all interfaces and exposes sensitive build data via an unauthenticated API endpoint with wildcard CORS, allowing remote attackers to retrieve complete source code and build metadata without any authentication or authorization.
The flaw allows an attacker to exploit XML External Entity (XXE) attacks, leading to file disclosure, SSRF, and denial of service.
The flaw allows attackers to bypass security guardrails by injecting special-token literals into web crawl results, leading to arbitrary command execution within the Kali Linux sandbox.