All CVEs — page 615 of 631
The complete archive, 25 per page, newest first. 15775 records. Search instead.
The flaw allows any authenticated user to manipulate notes from another company due to missing company-ownership verification, posing a significant security risk.
The flaw allows unauthorized access to sensitive API endpoints by enumerating card_id values, compromising user data security.
The flaw allows untrusted user input to be directly rendered in email templates, leading to potential template injection attacks.
The flaw lies in DjangoCRM hardcoding the Django SECRET_KEY in the settings.py file, allowing anyone to read the public repository to forge session cookies, CSRF tokens, and password reset tokens, leading to full account takeover.
The flaw allows an unauthenticated attacker to bypass authentication and potentially extract database data via SQL injection, posing a critical security risk.
The flaw lies in the manual reversal of HTML entity encoding after purification with HTMLPurifier, potentially allowing for injection of malicious scripts.
The flaw allows authenticated users to execute arbitrary Lua scripts, leading to remote code execution (RCE) and potential data exfiltration or system compromise.
The flaw allows unauthorized access to document downloads by merely providing a non-empty query parameter, leading to potential data exposure.
The flaw allows an attacker to inject malicious HTML into the client portal by exploiting the raw output directive in the 'terms' field, leading to Cross-Site Scripting (XSS).
The flaw allows execution of dangerous PHP functions in template content due to incomplete blacklist filtering, enabling remote code execution.
The flaw allows an attacker to execute arbitrary SQL commands by injecting malicious input into the decoded cookie value, leading to potential unauthorized access to user data.
The Zbtlink router firmware contains an embedded implant called ENDLESSDOORS that provides unauthenticated remote code execution as root, posing a critical security risk.
The flaw allows an attacker to perform unauthenticated arbitrary file writes outside the workspace, potentially leading to remote code execution.
The flaw allows unauthenticated attackers to read arbitrary files by manipulating path parameters in the `/hostedPlugin` endpoint, due to improper path resolution.
A privilege escalation vulnerability allows authenticated users to gain full administrative access, bypassing role-based access controls.
The flaw allows unauthorized access to sensitive information via the /network/graph API due to missing authentication, posing a significant security risk.
The flaw allows a user with namespace-scoped 'edit' privileges to create a Subscription resource that includes cluster-scoped resources, leading to full cluster-admin privilege escalation.
The flaw allows a tenant administrator with namespace-scoped privileges to escalate their permissions by creating a namespaced ClusterCurator, leading to full cluster control.