All CVEs — page 663 of 678
The complete archive, 25 per page, newest first. 16938 records. Search instead.
The flaw allows unauthenticated access to sensitive resources via URL-encoded paths, potentially enabling unauthorized data exposure.
The flaw allows direct SQL injection due to lack of parameterization and escaping, and includes hardcoded admin credentials, enabling full authentication bypass.
The flaw lies in the CheckToken function, which does not re-fetch the account from the database even if the JWT's HMAC signature is valid. This can lead to unauthorized access to user accounts.
The flaw allows for potential out-of-bounds memory access due to improper validation of offset parameters in the crop function, which could lead to arbitrary code execution if exploited.
The flaw allows a negative ratio to cause image processing functions to fail, potentially crashing the application due to invalid width values.
The flaw allows remote code execution by manipulating the ratio parameter in imagecli's pipeline operation without proper validation, leading to potential crashes or arbitrary code execution.
The flaw in Pluck CMS's admin panel allows attackers to perform cross-site request forgery (CSRF) attacks by manipulating the Referer header, leading to potential unauthorized actions.
The flaw allows unauthenticated attackers to access sensitive information such as API keys and task parameters through the `getCurrentTaskResults()` method in the AIWU plugin for WordPress.
The flaw allows unauthenticated attackers to modify or delete Stripe payment credentials, potentially redirecting payments to attacker-controlled accounts or disabling the Stripe integration entirely.
The LightSync Pro plugin for WordPress allows attackers to upload arbitrary files due to missing file type validation, posing a risk of remote code execution for users with Author-level access or higher.
The flaw allows unauthenticated attackers to modify and access data through missing capability checks in the Material Dashboard plugin for WordPress.
The flaw allows arbitrary function execution via an unfiltered user input parameter, enabling authenticated attackers with Administrator-level access to run any PHP code.
This vulnerability in the Linux kernel allows a race condition where a per-socket policy change can race with a send operation, leading to a double-free of the socket's dst cache, potentially causing a kernel crash or denial of service.
The vulnerability in the Linux kernel's xfrm6 module allows for a double netdev_put underflow, potentially leading to a denial of service or other kernel issues.
This vulnerability allows a remote client to perform a slab-out-of-bounds read by crafting a compound SMB2 request, potentially leading to information disclosure.
This vulnerability in the Linux kernel's GTP (Generic Tunneling Protocol) implementation allows a malicious packet with specific payload to cause a kernel panic by triggering an invalid memory access.
The flaw is a potential general protection fault due to uninitialized netlink_ext_ack pointer dereferencing in the Linux kernel's nexthop module. This matters because it could lead to a kernel panic or system instability if exploited.
The flaw allows a null pointer dereference in the Linux kernel, potentially leading to a system crash or denial of service.
The flaw involves a use-after-free vulnerability in the Linux kernel's mac80211 subsystem, where debugfs entries are not properly removed when adding new links, leading to potential memory corruption.