All CVEs — page 730 of 854
The complete archive, 25 per page, newest first. 21350 records. Search instead.
The flaw allows a remote attacker to execute arbitrary code by exploiting the MLflow statsmodel flavor's lack of deserialization security control.
The flaw allows a remote attacker to execute arbitrary code by crafting a specific MLmodel artifact, due to the lack of proper deserialization security control.
The flaw allows attackers to inject arbitrary JavaScript code by manipulating the operationId parameter, leading to remote code execution.
The flaw allows code injection in the form-data serializer, enabling attackers to inject malicious ${...} expressions that can be executed during the generation of FormData bodies.
The flaw allows attackers to inject JavaScript by exploiting crafted media-type keys in OpenAPI specifications, leading to remote code execution.
The flaw allows attackers to inject arbitrary expressions via date default values in OpenAPI schema defaults, leading to code execution with the consumer process privileges.
The flaw allows attackers to inject arbitrary JavaScript expressions via OpenAPI schema defaults, leading to remote code execution.
The flaw allows code injection by failing to escape OpenAPI path values, enabling arbitrary JavaScript code execution.
The flaw allows the MQTT broker to start without configured authentication or authorization, potentially exposing the system to unauthorized access.
Moquette MQTT broker has a session collision vulnerability where client IDs ending in '_meta' can cause message maps to collide with other clients' metadata maps, leading to data corruption and message loss. This affects durable sessions and can result in misdelivery or exposure of queued content across sessions.
Moquette MQTT broker has a privilege escalation flaw where clients can publish unauthorized Last-Will messages to topics they don't have write permissions for, allowing injection of messages into restricted topics when clients disconnect unexpectedly.
Moquette MQTT broker has a memory exhaustion vulnerability where unbounded message queues can accumulate in memory or storage, allowing remote attackers to cause denial of service by exhausting broker resources.
Moquette MQTT broker suffers from unlimited topic depth recursion that leads to StackOverflowError and service denial when remote clients publish or subscribe with deeply nested topics. This vulnerability allows attackers to disrupt broker sessions and deny service to legitimate clients.
Moquette MQTT broker has a vulnerability in shared subscription handling where malformed topic filters can cause a StringIndexOutOfBoundsException, leading to denial of service for other clients on the same session event loop.
Moquette MQTT broker has a flaw where unhandled exceptions in session processing can terminate shared event loops, causing multiple client sessions to stop processing MQTT commands like PUBLISH and SUBSCRIBE. This affects all clients sharing the same terminated loop, potentially disrupting the entire broker's functionality.
This vulnerability allows an attacker to inject OS commands, leading to arbitrary command execution as the user running the explore command. It matters because it can be exploited to gain full control over the system.
BusyBox TLS implementation contains a heap buffer overflow vulnerability in its Montgomery reduction function due to incorrect buffer allocation size, allowing attackers to trigger memory corruption when processing specially crafted ClientKeyExchange messages without authentication.