All CVEs — page 739 of 854
The complete archive, 25 per page, newest first. 21350 records. Search instead.
The flaw allows unauthenticated attackers to write arbitrary PHP files on the server, leading to Remote Code Execution (RCE) when the caching feature is enabled.
An attacker can manipulate file paths to access files outside of the intended directory structure, potentially leading to unauthorized data access or system compromise. This path traversal vulnerability allows bypassing directory restrictions that should limit file access.
The divi-dash WordPress plugin before 1.0.7 fails to validate the client IP address used for rate limiting and banning, allowing attackers to spoof IP addresses and bypass these features, leading to potential denial of service.
The flaw allows unauthenticated users to extract arbitrary data, including password hashes, by injecting a payment token into a SQL statement without proper sanitization.
The flaw is a stack-based buffer overflow in the copy_msg_element function of the Device Discovery Service in Fast FAC1203R Gigabit Edition 2.0.4, which can lead to remote code execution. This issue is critical as it allows attackers to exploit the vulnerability to gain control over the affected system.
The flaw allows attackers to cause quadratic CPU consumption during JSON deserialization when processing collections or maps with @JsonIdentityInfo enabled. This happens when objects are referenced before they're defined, leading to excessive identity comparisons that grow exponentially with input size.
The flaw allows attackers to cause unbounded memory growth by repeatedly supplying unique unknown type IDs in JSON deserialization, leading to memory exhaustion. This occurs when applications use name-based polymorphism with fallback deserializers and reuse ObjectMapper instances across requests.
The flaw allows attackers to trigger unbounded memory growth through malformed JSON tokens when using DataInput-based parsing, leading to potential OutOfMemoryError and system instability. This affects FasterXML jackson-core versions 2.8.0 and later where UTF8DataInputJsonParser was introduced.