All CVEs — page 612 of 631
The complete archive, 25 per page, newest first. 15775 records. Search instead.
The flaw is an XML External Entity (XXE) injection vulnerability in IBM QRadar, allowing unauthorized access to sensitive information through improperly processed XML-formatted syslog events.
The flaw allows a malicious TLS server to cause a memory leak in a client that checks OCSP responses, potentially leading to Denial of Service.
The flaw allows any authenticated user to overwrite files and subscribe to WebSocket events, enabling data exfiltration and poisoning.
The flaw in Keycloak's Dynamic Client Registration (DCR) component allows attackers to write values to sensitive claim locations, potentially forging administrative roles and gaining full administrative control over the realm.
The flaw in Keycloak's PathMatcher allows attackers to bypass intended security policies by manipulating URL paths, potentially gaining unauthorized access to administrative or restricted areas.
This vulnerability allows a local, low-privileged attacker to escalate privileges to SYSTEM by creating a symlink/junction during the uninstallation of CCleaner prior to 7.10.1464, which CCleaner follows when deleting the application's data folder with elevated integrity.
The flaw allows unauthenticated attackers to modify and disclose data through REST API endpoints due to lack of proper permission checks.
Mistral Vibe before 2.23.3 allows attackers to execute arbitrary commands by embedding a malicious core.fsmonitor hook in a repository's .git/config file, posing a significant risk to system security.
The flaw allows unauthenticated attackers to inject arbitrary scripts via the 404 not_found_url parameter, leading to cross-site scripting (XSS). This matters because it can be exploited to steal user data or manipulate web pages.
The flaw in Keycloak's SAML metadata import functionality allows unauthenticated attackers to forge SAML responses and gain unauthorized access by exploiting missing usage attributes for keys.
The flaw allows an authenticated attacker with author-level access to delete arbitrary files via path traversal, potentially leading to remote code execution.
The flaw allows network attackers to access hardcoded credentials in RTSP authentication, enabling unauthorized viewing of camera footage.
The Cotonti CMS Comments plugin allows untrusted data deserialization without class restrictions, enabling attackers with comment write access to execute arbitrary code on the server. This vulnerability arises from insufficient sanitization of user-supplied data during comment creation.
The flaw allows for SQL injection by misusing request parameters in Subrion CMS, enabling attackers to execute arbitrary SQL commands.
The flaw allows untrusted content to be executed as Twig templates, leading to Remote Code Execution (RCE) due to the lack of sandboxing.
The flaw allows direct access to the amp-manager REST API without going through the CAM gateway, enabling unauthorized access and potential full system compromise.
The flaw allows an attacker to inject SQL commands via the guided report builder, leading to potential data manipulation or theft.
The flaw allows an attacker to inject SQL commands by manipulating ORDER BY column names, leading to potential SQL injection attacks.