All CVEs — page 715 of 854
The complete archive, 25 per page, newest first. 21350 records. Search instead.
The flaw is a memory access issue in nDPI's DNS dissector that occurs when processing specially crafted network input, potentially leading to process termination and denial of service. This vulnerability affects systems using nDPI 5.1.0 with strict alignment requirements or UBSan instrumentation.
BentoPDF 2.8.6 and earlier versions are vulnerable to a cross-origin resource sharing (CORS) proxy issue that allows attackers to forge the browser-oriented Origin header and potentially access internal or reserved destinations.
The Norwegian Cruise Line's door access control system only validates NFC credentials based on a static 7-byte UID from NTAG212 chips, treating identification as authentication without challenge-response capability. This allows attackers to copy valid credentials and gain unauthorized access.
Logto's Account API allowed users with only openid scope access tokens to retrieve stored social or enterprise SSO provider access tokens, bypassing intended consent boundaries. This creates a privilege escalation where low-trust applications can access upstream APIs using these disclosed tokens.
The flaw allows an unauthenticated attacker to bypass two-factor authentication by submitting a valid TOTP code without first authenticating with the account password, leading to potential account takeover, including administrator accounts.
HFS2 file server has a denial of service vulnerability where unauthenticated attackers can send a single crafted request to hang the serving thread in a busy loop, causing complete service unavailability that requires manual restart to recover from.
A path traversal vulnerability in pulpcore allows authenticated users with low-privilege repository permissions to read any file accessible to the Pulp server process by supplying a specially crafted URL.
The flaw is an integer overflow vulnerability in the MPack Node API that can lead to heap-buffer-overflow, memory corruption, and denial of service. This matters because it can be exploited to crash the application or gain control over the system.
The flaw allows a remote authenticated attacker to execute arbitrary code by deserializing untrusted data, posing a significant security risk.
This flaw allows a remote authenticated attacker to execute arbitrary commands due to improper handling of environment variables in IBM DataStage on Cloud Pak for Data 5.4.0.0, posing a significant security risk.