All CVEs — page 540 of 631
The complete archive, 25 per page, newest first. 15775 records. Search instead.
The flaw allows authenticated users to modify tenant system configurations, potentially leading to unauthorized changes in company identity, stock rules, approval behavior, and printing settings.
This vulnerability allows authenticated users to read other tenants' records by exploiting a tenant isolation bypass in jshERP through version 3.6, potentially exposing sensitive data.
The flaw allows authenticated users to modify role button-permission definitions without proper authorization checks, enabling them to overwrite configurations for any role in the tenant.
The flaw allows authenticated users to retrieve unsalted MD5 password hashes, enabling attackers to perform offline cracking or direct authentication bypass.
This vulnerability allows authenticated users to reset any other user's password, enabling unauthorized access to accounts, including administrative ones.
The vulnerability in jshERP 3.6 allows authenticated users to escalate their privileges by sending a POST request to the updateOneValueByKeyIdAndType endpoint, granting themselves arbitrary roles, including tenant administrator.
The flaw in ColorFul iGameCenter 1.0.3.4 involves an untrusted pointer dereference in the ene.sys library, allowing local exploitation. This vulnerability is significant due to its high impact on confidentiality, integrity, and availability.
This flaw allows a jump host key to be stored for a target address, enabling interception of user traffic and certificate authentication when exploited.
The flaw allows an attacker to use a leaked HTTP API token from prohibited network locations, potentially gaining unauthorized access. This matters because it can lead to data breaches or system compromise.
This vulnerability allows a low-privileged local attacker to exploit incorrect default permissions, leading to information disclosure.
The flaw is an Incorrect Default Permissions vulnerability in Dell Command | Intel vPro Out of Band versions prior to 4.7.2, allowing a low-privileged attacker with local access to potentially exploit it for Information Disclosure.
The flaw allows any authenticated regular user to subscribe to real-time terminal input and output from proxied sessions, including sensitive data, by identifying an active recording. This can lead to credential theft and other sensitive data exposure.
The flaw allows an attacker to authorize themselves as another user by manipulating headers in a proxied request, potentially leading to unauthorized access.
The flaw allows privileged users to retrieve attacker-selected resources through URL schemes or local file URIs during report rendering, leading to server-side request forgery and potential disclosure of sensitive files including credentials.
The flaw allows unauthorized access to report and label printing functionalities by bypassing permission checks, exposing sensitive data.
The flaw allows any authenticated user to access another user's import session data, exposing sensitive information. This matters because it breaches data privacy despite users being considered trusted within the InvenTree system.
The flaw allows unauthenticated access to plugin settings metadata and non-secret configuration values, posing a risk of sensitive information disclosure.
The flaw allows low-privilege users to enumerate primary keys and disclose sensitive inventory data by exploiting the lack of proper role checks in the InvenTree barcode API endpoint.
The flaw allows an attacker to inject malicious JavaScript into the response, potentially leading to session hijacking and unauthorized actions. It also enables open redirects, which can be used to redirect users to malicious sites.
Dell Command Powershell Provider versions prior to 2.10.2 can be exploited by a low-privileged attacker with local access to insert sensitive information into log files, leading to potential information disclosure.
The flaw allows an unprivileged user to write to kernel memory, potentially leading to privilege escalation or system crashes.
The flaw allows for Cross-Site Scripting (XSS) in the HTML exporter of Telegram Desktop before 6.9.4, which could lead to arbitrary script execution in the victim's browser if they opened a maliciously crafted message.