All CVEs — page 744 of 854
The complete archive, 25 per page, newest first. 21350 records. Search instead.
The flaw allows unauthenticated WebSocket clients to send oversized frame headers that trigger memory allocation panics or excessive memory consumption in SIPGO's WebSocket transport layer. This can lead to denial of service or memory exhaustion on the server.
The Analytics and Location Engine component in Aruba Networks improperly handles incoming socket connections, allowing unauthenticated remote attackers to inject unauthorized data during the connection process. This represents a significant security gap that could enable data manipulation without requiring authentication or user interaction.
The Analytics and Location Engine management interface has a vulnerability that allows unauthenticated remote attackers to disclose sensitive information about site hierarchy, infrastructure, and client devices. This represents a significant information disclosure risk as attackers can gain insights into network infrastructure without needing credentials.
The vulnerability allows unauthenticated remote attackers to gain unauthorized write access to the file system with elevated privileges, potentially leading to a full system compromise.
The flaw involves default, hard-coded credentials in the Analytics and Location Engine (ALE), allowing unauthenticated attackers to gain unauthorized access to the application and underlying system.
Kaneo versions 2.3.12 before 2.12.2 allow authenticated users with viewer or member roles to delete and modify tasks beyond their permissions by exploiting the bulk task endpoint, leading to unauthorized changes or deletions.
The flaw is a synchronous exception handling issue in request-filtering-agent where literal private IP addresses trigger uncaught exceptions instead of asynchronous error delivery, potentially crashing Node.js applications. This affects applications using RequestFilteringHttpAgent or RequestFilteringHttpsAgent when connecting to private IPs like 127.0.0.1 or 169.254.169.254.
MPXJ library is vulnerable to XML External Entity (XXE) processing when reading Merlin project files, allowing attackers to read arbitrary local files through crafted database inputs. This affects versions 5.5.5 through 16.4.1.
The psd-tools Python package had a memory allocation vulnerability where attacker-controlled PSD files could trigger massive memory allocations before validating file data, potentially causing out-of-memory crashes in services processing untrusted PSD files.
The flaw allows attackers to cause excessive memory allocation by sending SIP messages with oversized Content-Length headers before enforcing maximum message length limits. This leads to denial of service as the system allocates more memory than intended.
The flaw in LTSecurity LTK3500SF involves hard-coded weak credentials, allowing dictionary-based cracking tools to recover root and guest account passwords, which can then be used to gain root-level access via Telnet and SSH services.
The flaw allows unauthenticated remote code execution due to deserialization of untrusted data, posing a significant security risk.
The flaw allows unauthenticated remote code execution due to insufficient integrity checks, making it a critical vulnerability that can be exploited to gain full control over the system.
A buffer overflow vulnerability in UniFi gateway devices allows remote attackers to write data beyond the allocated memory bounds, potentially leading to a denial of service condition that can make the device unavailable to legitimate users.