All CVEs — page 758 of 854
The complete archive, 25 per page, newest first. 21350 records. Search instead.
The Give Tributes plugin for WordPress is vulnerable to PHP Object Injection, allowing unauthenticated attackers to inject a PHP Object if specific conditions are met.
The flaw allows unauthenticated attackers to escalate privileges to Administrator by exploiting a chained vulnerability in the Meta Box AIO plugin for WordPress.
A vulnerability in the Gigatech PDV5701 1.0.31_240305_112640 WebSocket Service allows for missing authentication, enabling remote attackers to exploit it.
The flaw allows SQL injection via manipulation of the operator argument in Yonyou U8cloud 5.x's OpenAPI module, enabling remote code execution.
The flaw is a SQL injection vulnerability in Yonyou KSOA 9.0 due to improper argument handling in search_list.jsp, allowing remote attackers to execute arbitrary SQL commands. This matters because it can lead to data theft or corruption.
Dancer2 web framework allows directory traversal through File route handler that doesn't properly collapse relative path segments, enabling access to files outside the designated public directory. This affects applications using static_handler=0 and explicitly naming File in route_handlers.
Dancer2 framework has a race condition in its hook execution where dying hooks can cause routes to be incorrectly dispatched even after the response has been halted, leading to unexpected behavior and potential data loss. This occurs when exception handlers halt responses but don't prevent cleanup that discards request data, allowing stale routes to execute.
The flaw allows unauthenticated attackers to craft a malicious link that can exfiltrate sensitive information from an authenticated user's session in SAP Fiori Launchpad.
The flaw allows for os command injection through manipulation of the argument command in OctoPrint's Command API, enabling remote code execution.
The vulnerability allows path traversal through manipulation of the filename argument in OctoPrint's File Download API, enabling unauthorized access to files.
The vulnerability allows for cross-site scripting due to improper input handling in the Name argument of the /jobgroup/insert function, enabling remote attackers to inject malicious scripts.
The vulnerability in Moore Threads MTT S80 Driver Package 340.150 allows for improper privilege management, enabling local attackers to exploit it for high impact consequences.
The vLLM Mooncake connector has a memory management flaw where GPU KV cache blocks aren't properly released when concurrent requests share the same transfer ID, leading to gradual memory exhaustion that eventually prevents legitimate requests from processing.
The vLLM library fails to validate the tp_size parameter in kv_transfer_params, allowing unbounded memory allocation during prefill/decode operations. This vulnerability can lead to memory exhaustion and kernel OOM-kill of decode worker processes.
The vulnerability allows attackers to send rejected prefill requests that create ownerless transfer placeholders, leading to resource exhaustion and delayed processing of valid requests.
The vulnerability allows attackers to cause a denial of service by configuring vLLM with specific P2P KV offloading settings that create unreachable peer sessions, leading to ZeroMQ socket exhaustion and EngineCore crashes. This affects inference services that use the affected offloading features.
The vLLM library has a denial of service vulnerability in its NIXL connector's prefix caching implementation that fails to properly validate block counts when handling multiple prompts in prefill/decode deployments, leading to assertion failures and worker termination.
The flaw allows attackers to cause a denial of service by sending requests with incomplete metadata entries, leading to engine termination and failure of routed requests.
DesktopSMS 1.11.0 allows local attackers to perform unauthorized SMS operations by interacting with the local service, potentially leading to the transmission and retrieval of SMS content and the persistence of attacker-controlled identities.