All CVEs — page 734 of 854
The complete archive, 25 per page, newest first. 21350 records. Search instead.
Apache Tomcat's WebSocket implementation incorrectly handles length parameters when per-message-deflate compression is enabled, allowing attackers to smuggle WebSocket messages that bypass normal message boundaries and potentially manipulate message processing.
This flaw involves an inconsistent interpretation of HTTP/2 requests, leading to potential request header mix-ups, which can be exploited to manipulate HTTP requests and responses.
The flaw allows CLIENT_CERT authentication to fail improperly when soft fail is disabled, leading to potential unauthorized access.
This vulnerability allows a low-privilege user to escalate privileges to Administrator by importing a malicious Report Profile, posing a significant security risk.
Apache Tomcat suffers from a resource leak vulnerability where WebSocket connections are not properly released after their lifetime, leading to lost timeouts and eventual denial of service. This occurs when asynchronous WebSocket writes fail to release resources correctly.
Apache Tomcat suffers from a resource allocation flaw where unauthenticated AJP requests can pin processing threads, causing denial of service. This vulnerability allows attackers to exhaust available threads and make the server unavailable to legitimate users.
Apache Tomcat is vulnerable to a DoS attack through uncontrolled resource consumption during WebSocket close message processing, allowing attackers to exhaust system resources and make the service unavailable.
This flaw involves a race condition in Apache Tomcat that allows attackers to inject trailer fields into another HTTP/2 request, potentially leading to unauthorized actions or data manipulation.
This flaw allows authentication bypass for WebSocket endpoints, enabling unauthorized access. It matters because it can lead to full compromise of the application and system.
An unauthorized path traversal vulnerability allows attackers to access files outside the intended directory structure, potentially leading to sensitive data exposure. This affects ZohoCorp ManageEngine OpManager and Network Configuration Manager versions before 12.8.671.
This vulnerability allows an attacker to inject malicious SQL queries, potentially leading to data theft, manipulation, or system compromise.
A Server-Side Template Injection vulnerability in ZohoCorp ManageEngine's Configlet processing allows attackers with limited privileges to execute arbitrary code on the server. This affects multiple products including OpManager, NetFlow Analyzer, and Network Configuration Manager.
The Reachy Mini daemon lacks authentication for its app installation endpoint, allowing anyone to install arbitrary Python packages and execute their code on the robot.
A code execution flaw in Emacs versions prior to 31.2 allows arbitrary code execution during syntax checking of untrusted files, posing a significant security risk.