All CVEs — page 510 of 631
The complete archive, 25 per page, newest first. 15775 records. Search instead.
The flaw allows any Owner of one company to read and overwrite any user account in any other company, leading to cross-tenant disclosure of user data and full account takeover.
LightLLM through 1.2.0 has a remote code execution vulnerability due to an unauthenticated RPyC control channel that deserializes attacker-supplied data, allowing arbitrary code execution with the service account privileges.
The flaw allows an unprivileged local user to manipulate the TZ environment variable to extend their access window, potentially executing unauthorized commands outside the intended time window.
The flaw allows unauthenticated attackers to access a Google Cloud service-account private key in the Applications Manager installer, enabling them to impersonate the service account and potentially access or modify cloud resources.
This flaw allows a low-privileged user to change proxy settings, potentially leading to unauthorized access or configuration changes.
A permissions validation flaw in ZohoCorp ManageEngine Applications Manager allows low-privileged users to execute high-privileged MBean actions on monitors they shouldn't have access to, potentially enabling unauthorized configuration changes and elevated privileges.
This flaw allows a low-privileged user to obtain an administrator’s API key, enabling them to perform administrator-level actions, which can lead to unauthorized access and data manipulation.
This flaw allows a low-privileged user to execute unauthorized SQL commands, potentially gaining full administrative access and remote code execution, which can lead to complete compromise of the affected system.
The flaw in SunEditor allows event-handler attributes to remain on crafted elements, enabling stored cross-site scripting and potentially leading to data exposure or unauthorized actions.
The flaw allows attackers to manipulate SSL/TLS renegotiation and encryption settings, potentially leading to unauthorized access or data exposure.
This vulnerability allows an attacker to inject malicious XML data, potentially leading to unauthorized access or data manipulation in the Rule Tracking Compare Policies feature of ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.709 and below.
The flaw allows command injection in the Diagnose Settings feature, enabling an attacker to execute arbitrary commands on the server.
This vulnerability allows an attacker to bypass authentication in ZohoCorp ManageEngine OpManager versions 12.8.710 and below with the Application Manager Plugin enabled, leading to unauthorized access and potential system compromise.
This vulnerability allows remote code execution in the Notification Profile module of ZohoCorp ManageEngine OpManager MSP versions 12.8.709 and below, enabling attackers to execute arbitrary code on the affected system.