All CVEs — page 710 of 854
The complete archive, 25 per page, newest first. 21350 records. Search instead.
The flaw allows an attacker to inject arbitrary JavaScript via a crafted video placeholder, leading to potential execution in the viewer's session.
The flaw allows crafted JavaScript input to cause an out-of-bounds write, leading to memory corruption and potential application crashes or denial of service.
The vulnerability is an uncontrolled memory allocation in hiredis's RESP aggregate parser, which can lead to excessive memory consumption and potentially cause denial of service. This affects applications using hiredis for Redis communication.
The flaw is a heap out-of-bounds write condition in QuickJS, which can lead to arbitrary code execution if exploited. This matters because it allows attackers to execute malicious code, leading to severe system compromise.
Bento4 library contains an integer underflow vulnerability in AP4_AvccAtom::Create() and AP4_HvccAtom::Create() functions that can cause applications to crash when processing specially crafted MP4 files with invalid avcC or hvcC atoms, leading to denial of service.
The vulnerability is a NULL pointer dereference in libde265's NAL parsing code that occurs when processing zero-length NAL units. This flaw can lead to denial of service by causing process termination, particularly in UBSan-instrumented builds.
The vulnerability is an integer overflow in libsndfile's MAT4 file parser that can lead to heap-based buffer overflows during audio file processing. This allows attackers to manipulate memory layout and potentially execute arbitrary code when applications process maliciously crafted MATLAB v4 audio files.
The flaw allows an authenticated administrator to execute arbitrary commands via shell interpolation, leading to remote code execution.
The flaw allows a low-privilege user to exfiltrate internal service data and cloud credentials by manipulating the URL query parameter in the /homepage/proxy endpoint.
The flaw allows an authenticated user to upload XML and XSLT files, which can then be executed in the browser, leading to potential data exfiltration and privilege escalation.
A password-authenticated session can obtain a persistent API token before completing a second-factor challenge, allowing access to resources with the victim's permissions.
A user with the customfields.create permission can inject markup into CustomField.name, which is then executed when another user views the asset-list page. This allows for data exposure and potential privilege escalation.