All CVEs — page 562 of 631
The complete archive, 25 per page, newest first. 15775 records. Search instead.
SysReptor Professional allows authenticated users to upload image files that can execute arbitrary code due to improper handling of Ghostscript and GnuPG, leading to Remote Code Execution (RCE) with the application's privileges.
The flaw allows an unauthenticated attacker to exploit a misconfiguration in the password reset feature to take over a victim's account.
Authenticated non-admin users could influence file paths, potentially allowing unauthorized file placement or overwrite with application privileges.
The flaw allows unauthenticated attackers to crash the Icinga 2 process by sending deeply nested JSON, posing a significant risk to the availability of the service.
The flaw allows an unauthenticated attacker to replace node and CA certificates, enabling them to impersonate trusted nodes and gain control over them.
The flaw in Mnemosyne allows any well-formed token to be accepted by the sync server, bypassing signature verification, which could lead to unauthorized access to the system.
The flaw allows an attacker to execute arbitrary Python code by crafting a specific `quantization_config.quant_dtype` value, leading to remote code execution.
LMDeploy's PyTorch DistServe/PD-disaggregation control plane deserializes messages using Python pickle, allowing remote code execution if an attacker can reach the `/distserve/p2p_connect` endpoint.
This flaw in Mongoid allows unauthenticated input to trigger unintended internal method invocations, potentially leading to data loss and application unresponsiveness.
The flaw allows a user with basic application privileges to reference and modify another user's record, leading to unintended data disclosure and unauthorized modifications.