All CVEs — page 487 of 631
The complete archive, 25 per page, newest first. 15775 records. Search instead.
The flaw allows an attacker to inject arbitrary JavaScript via a crafted video placeholder, leading to potential execution in the viewer's session.
The flaw allows crafted JavaScript input to cause an out-of-bounds write, leading to memory corruption and potential application crashes or denial of service.
The vulnerability is an uncontrolled memory allocation in hiredis's RESP aggregate parser, which can lead to excessive memory consumption and potentially cause denial of service. This affects applications using hiredis for Redis communication.
The flaw is a heap out-of-bounds write condition in QuickJS, which can lead to arbitrary code execution if exploited. This matters because it allows attackers to execute malicious code, leading to severe system compromise.
The flaw allows an authenticated administrator to execute arbitrary commands via shell interpolation, leading to remote code execution.
The flaw allows a low-privilege user to exfiltrate internal service data and cloud credentials by manipulating the URL query parameter in the /homepage/proxy endpoint.
The flaw allows an authenticated user to upload XML and XSLT files, which can then be executed in the browser, leading to potential data exfiltration and privilege escalation.
A password-authenticated session can obtain a persistent API token before completing a second-factor challenge, allowing access to resources with the victim's permissions.
A user with the customfields.create permission can inject markup into CustomField.name, which is then executed when another user views the asset-list page. This allows for data exposure and potential privilege escalation.