All CVEs — page 543 of 631
The complete archive, 25 per page, newest first. 15775 records. Search instead.
This flaw allows for an allow-list bypass via java.lang.reflect.Proxy, enabling unauthorized access. It matters because it can lead to remote code execution or data leakage.
The flaw is a stack-based buffer overflow in fetchmail when built with NTLM support, allowing a malicious mail server to potentially execute arbitrary code.
The flaw allows authenticated users with Author-level privileges or higher to inject arbitrary HTML elements by supplying malicious wrapper attribute values, leading to cross-site scripting attacks.
The flaw allows an attacker to maintain access to an Apache Airflow instance after a user logs out, as the logout endpoint does not revoke the token when presented via an Authorization header, leaving the token valid for up to 24 hours.
This vulnerability allows an attacker to bypass intended authentication by using a session cookie and an explicit bearer token, with Airflow resolving the caller from the cookie instead of the token.
The flaw in pki-core allows a wildcard ACL to override a more specific literal ACL, potentially allowing a lower-privileged group to perform actions intended for a higher-privileged group, compromising the certificate authority's issuance policy.
The flaw in openshift/oc-mirror allows for PGP signature verification bypass, enabling remote attackers to forge signatures and mirror malicious release payloads into a disconnected registry.
The flaw allows any authenticated user with asset-read access to enumerate asset events for all Dags in the deployment, including those they are not authorized to see, due to missing access control filters.
The flaw allows any user with OTP 2FA enabled to reuse their TOTP during a 30-second window, potentially leading to unauthorized access.
The flaw allows unauthenticated attackers to perform a denial of service (DoS) by sending specially crafted requests that consume excessive CPU resources.
The flaw allows a remote unauthenticated attacker to create a full admin account by exploiting a race condition in the onboarding process of nginx ignition.
The flaw allows pipeline group administrators to test connections for source control materials outside their authorized scope, potentially exposing credentials. It also enables resolution of external secrets managed by secret-management plugins.
The flaw allows a local unprivileged user to replace a target directory with a Windows junction and symlink to redirect privileged file deletions to attacker-selected files, potentially obtaining SYSTEM privileges.
The flaw allows an attacker to inject arbitrary Stata commands by embedding newline characters, leading to full OS-level arbitrary command execution.
The flaw allows an authenticated internal user to view sensitive information from source control child processes, including command-line arguments and material paths, which could be exploited for unauthorized access.
The flaw allows authenticated users to guess job IDs and retrieve status for jobs in pipelines they shouldn't have access to, potentially exposing sensitive information.