All CVEs — page 505 of 631
The complete archive, 25 per page, newest first. 15775 records. Search instead.
The flaw allows an attacker to inject arbitrary commands via the scm_url field, leading to remote code execution on the control-plane task pod.
The flaw allows a user with the JobTemplate Admin role to recover another user's stored password in plaintext by tightening survey length constraints and revalidating a schedule or node.
The flaw allows unauthenticated attackers to repeatedly invoke debug endpoints, causing the scheduler advisory lock to be acquired, leading to job dispatch stalling and resource consumption.
The flaw allows a minimally privileged or unauthenticated attacker to read a secret and launch job templates against arbitrary hosts, leading to privilege escalation and remote code execution.
Authenticated non-administrator users can write content that is later executed with elevated privileges, leading to remote code execution.
The flaw allows an authenticated actor to write a malicious setting that can execute arbitrary shell commands, leading to Remote Code Execution (RCE).
A stored cross-site scripting vulnerability in OpenC3 COSMOS allows authenticated users with system_set permissions to inject malicious scripts into shared screens, which then execute in other users' browser sessions when button widgets are activated. This enables attackers to steal bearer tokens and perform actions as the victim.
The flaw allows an attacker to bypass object-level RBAC for the POST method in CopyAPIView, enabling unauthorized creation and copying of JobTemplates without read access.
The flaw allows any authenticated user to read recipient headers and complete HTML email bodies containing submitted form data by invoking a specific control panel action without proper authorization checks, posing a significant privacy risk.
The flaw allows an unauthenticated attacker to overwrite or hijack another user's in-progress form submission by exploiting the submissionId parameter, leading to potential data tampering and persistence.
The flaw allows an authenticated attacker to bypass permission checks and modify form integration settings, potentially exposing internal network responses and credentials.
This vulnerability allows local users to execute arbitrary code as root by injecting malicious pppd options through a crafted VPN username, leading to privilege escalation.