All CVEs — page 507 of 631
The complete archive, 25 per page, newest first. 15775 records. Search instead.
The flaw allows a remote attacker to execute arbitrary code by exploiting the MLflow statsmodel flavor's lack of deserialization security control.
The flaw allows a remote attacker to execute arbitrary code by crafting a specific MLmodel artifact, due to the lack of proper deserialization security control.
The flaw allows attackers to inject arbitrary JavaScript code by manipulating the operationId parameter, leading to remote code execution.
The flaw allows code injection in the form-data serializer, enabling attackers to inject malicious ${...} expressions that can be executed during the generation of FormData bodies.
The flaw allows attackers to inject JavaScript by exploiting crafted media-type keys in OpenAPI specifications, leading to remote code execution.
The flaw allows attackers to inject arbitrary expressions via date default values in OpenAPI schema defaults, leading to code execution with the consumer process privileges.
The flaw allows attackers to inject arbitrary JavaScript expressions via OpenAPI schema defaults, leading to remote code execution.
The flaw allows code injection by failing to escape OpenAPI path values, enabling arbitrary JavaScript code execution.
The flaw allows the MQTT broker to start without configured authentication or authorization, potentially exposing the system to unauthorized access.
This vulnerability allows an attacker to inject OS commands, leading to arbitrary command execution as the user running the explore command. It matters because it can be exploited to gain full control over the system.