All CVEs — page 728 of 854
The complete archive, 25 per page, newest first. 21350 records. Search instead.
The flaw allows an attacker to inject arbitrary commands via the scm_url field, leading to remote code execution on the control-plane task pod.
The flaw allows a user with the JobTemplate Admin role to recover another user's stored password in plaintext by tightening survey length constraints and revalidating a schedule or node.
The flaw allows unauthenticated attackers to repeatedly invoke debug endpoints, causing the scheduler advisory lock to be acquired, leading to job dispatch stalling and resource consumption.
The flaw allows a minimally privileged or unauthenticated attacker to read a secret and launch job templates against arbitrary hosts, leading to privilege escalation and remote code execution.
The Imprivata EAM system fails to rotate RSA key pairs used for X.509 certificate generation, creating a persistent vulnerability that allows attackers to potentially impersonate legitimate certificates and gain unauthorized access to systems. This weakness stems from using the same RSA key indefinitely, which violates security best practices.
Authenticated non-administrator users can write content that is later executed with elevated privileges, leading to remote code execution.
The flaw allows an authenticated actor to write a malicious setting that can execute arbitrary shell commands, leading to Remote Code Execution (RCE).
JLine's built-in less viewer is vulnerable to catastrophic backtracking in regular expressions when processing user-controlled search patterns, leading to CPU exhaustion and potential denial of service. This affects systems using JLine for console input handling.
JLine library contains a vulnerable grep command that can be exploited through crafted regular expressions, leading to CPU exhaustion and command worker blocking. This vulnerability affects versions 3.0.0 through 3.30.14 and 4.0.0 through 4.3.0 where nested quantifiers in user-controlled regex patterns can cause excessive backtracking and indefinite blocking.
A stored cross-site scripting vulnerability in OpenC3 COSMOS allows authenticated users with system_set permissions to inject malicious scripts into shared screens, which then execute in other users' browser sessions when button widgets are activated. This enables attackers to steal bearer tokens and perform actions as the victim.
The flaw allows an attacker to bypass object-level RBAC for the POST method in CopyAPIView, enabling unauthorized creation and copying of JobTemplates without read access.
The flaw allows any authenticated user to read recipient headers and complete HTML email bodies containing submitted form data by invoking a specific control panel action without proper authorization checks, posing a significant privacy risk.
The flaw allows an unauthenticated attacker to overwrite or hijack another user's in-progress form submission by exploiting the submissionId parameter, leading to potential data tampering and persistence.
The flaw allows an authenticated attacker to bypass permission checks and modify form integration settings, potentially exposing internal network responses and credentials.
This vulnerability allows local users to execute arbitrary code as root by injecting malicious pppd options through a crafted VPN username, leading to privilege escalation.