All CVEs — page 613 of 631
The complete archive, 25 per page, newest first. 15775 records. Search instead.
The flaw allows unauthenticated visitors to execute arbitrary JavaScript, leading to potential session-cookie theft and full page takeover.
The flaw allows an admin to execute arbitrary OS commands by crafting a backup archive, leading to Remote Code Execution (RCE).
The flaw allows an attacker to execute arbitrary code by loading malicious cache/covariance files, posing a significant security risk.
The flaw allows an attacker to exploit go-shiori's DownloadBookmark function by providing a malicious URL, leading to potential unauthorized access or execution of code.
The flaw allows an attacker to execute arbitrary code by manipulating the file path in an MQTT message, leading to remote code execution.
The vulnerability allows an attacker to create a 'calc rule' without authentication, leading to potential unauthorized access and manipulation of the system.
The flaw allows an attacker to bypass authentication by sending any non-empty Authorization header, granting access to protected endpoints.
The flaw allows SQL injection by authenticated users due to direct interpolation of unvalidated HTTP query string values into raw SQL queries.
The flaw allows an attacker to inject malicious HTML content via the MQTT SetChannelLabel command, which can lead to Cross-Site Scripting (XSS) attacks.
The flaw lies in the safeDialContext function of Memos' webhook dispatch, which fails to use validated IP addresses for network connections, potentially allowing attackers to exploit DNS resolution to execute unauthorized actions.
The flaw lies in the webhook URL validation function, where the IP validation is incomplete, potentially allowing external IPs to be accepted, which could lead to unauthorized access or misuse.
The flaw allows an attacker to exploit a SSRF vulnerability in Stirling-PDF's API, potentially leading to unauthorized access to internal resources.
The flaw allows an attacker to traverse directories and potentially execute arbitrary code by manipulating path parameters in Node-RED's local-filesystem library storage module.
The flaw allows an attacker to execute arbitrary code by manipulating file paths in Structured Text (.st) program files, due to lack of proper validation.
The flaw in microtar allows an attacker to overwrite the 100-byte field of a stack-allocated structure via a long entry name, leading to potential buffer overflow and execution of arbitrary code.
The flaw in tinyobjloader-c allows an attacker to overflow a stack buffer by manipulating a .mtl file, leading to potential code execution or data corruption.
The flaw involves an insecure use of strcpy without length checking, leading to potential stack buffer overflow when processing MOCHAD_RFSEC messages in Domoticz.
The flaw allows unauthenticated clients to access the device's general configuration, including network, hardware, and LED setup details, posing a security risk.
The flaw in LINUXTCP port of FreeModbus involves an off-by-one error in a bounds check, leading to potential buffer overflow if exploited.
The IoTSharp BlobStorageController.cs lacks proper authorization, allowing unauthenticated attackers to manipulate storage endpoints, leading to potential data breaches and unauthorized access.