All CVEs — page 569 of 631
The complete archive, 25 per page, newest first. 15775 records. Search instead.
The flaw allows untrusted code to escape a sandbox and execute arbitrary code on the host system by calling non-strict functions with an undefined receiver, leading to Remote Code Execution (RCE).
ArcadeDB versions before 26.9.1 allow authenticated attackers to exploit SSRF vulnerabilities by using IPv6 transition addresses to reach internal services and cloud metadata endpoints.
The flaw allows an authenticated user to bypass access controls by executing SQL queries through LSM index files or the TimeSeries engine, leading to unauthorized data access and manipulation.
The flaw allows an authenticated low-privilege user to bypass security-group type ACL entries for TimeSeries types, leading to unauthorized read or insert access to TimeSeries samples.
A SQL injection vulnerability exists in SiYuan's graph.go query2Stmt function where tag values are directly concatenated into SQL queries without proper escaping, allowing remote attackers to execute arbitrary database queries and access private data across notebooks.
The flaw allows an attacker to cause the Imager Perl module to exit unexpectedly by providing a TGA file with a colour map length of 32768 or more, leading to a denial of service.
The flaw allows command injection in handle_import_privilege.php, enabling an attacker to execute arbitrary commands on the server.