All CVEs — page 595 of 631
The complete archive, 25 per page, newest first. 15775 records. Search instead.
The flaw allows restricted code to escape the sandbox by accessing standard library functions and classes, leading to potential RCE, data leakage, and integrity issues.
The flaw in Keycloak's policy enforcer allows an authenticated user to manipulate web addresses with special encoded characters, potentially bypassing intended security policies and gaining unauthorized access.
The flaw allows an attacker to inject executable JavaScript via SVG xlink:href, leading to potential code execution in the page origin.
The flaw in the rmcp crate's OAuth implementation allows a malicious MCP server to trick a victim into obtaining a legitimate access token, which can then be captured and used by the attacker to impersonate the victim.
This vulnerability allows authenticated attackers to delete arbitrary users' files and metadata by exploiting the DELETE /files/{id} endpoint in the file-center module of zlt2000 microservices-platform versions through 6.0.0, due to a lack of ownership validation.
This vulnerability allows authenticated users to change any account password without verifying the current password, posing a significant risk to account security.
The flaw allows authenticated users without roles to access administrative APIs, leading to unauthorized access and potential data manipulation.