All CVEs — page 492 of 631
The complete archive, 25 per page, newest first. 15775 records. Search instead.
BentoPDF 2.8.6 and earlier versions are vulnerable to a cross-origin resource sharing (CORS) proxy issue that allows attackers to forge the browser-oriented Origin header and potentially access internal or reserved destinations.
Logto's Account API allowed users with only openid scope access tokens to retrieve stored social or enterprise SSO provider access tokens, bypassing intended consent boundaries. This creates a privilege escalation where low-trust applications can access upstream APIs using these disclosed tokens.
The flaw allows an unauthenticated attacker to bypass two-factor authentication by submitting a valid TOTP code without first authenticating with the account password, leading to potential account takeover, including administrator accounts.
A path traversal vulnerability in pulpcore allows authenticated users with low-privilege repository permissions to read any file accessible to the Pulp server process by supplying a specially crafted URL.
The flaw is an integer overflow vulnerability in the MPack Node API that can lead to heap-buffer-overflow, memory corruption, and denial of service. This matters because it can be exploited to crash the application or gain control over the system.
The flaw allows a remote authenticated attacker to execute arbitrary code by deserializing untrusted data, posing a significant security risk.
This flaw allows a remote authenticated attacker to execute arbitrary commands due to improper handling of environment variables in IBM DataStage on Cloud Pak for Data 5.4.0.0, posing a significant security risk.