All CVEs — page 894 of 912
The complete archive, 25 per page, newest first. 22791 records. Search instead.
The flaw allows an attacker to bypass authentication by sending any non-empty Authorization header, granting access to protected endpoints.
The flaw allows SQL injection by authenticated users due to direct interpolation of unvalidated HTTP query string values into raw SQL queries.
The flaw allows an attacker to inject malicious HTML content via the MQTT SetChannelLabel command, which can lead to Cross-Site Scripting (XSS) attacks.
The flaw lies in the safeDialContext function of Memos' webhook dispatch, which fails to use validated IP addresses for network connections, potentially allowing attackers to exploit DNS resolution to execute unauthorized actions.
The flaw lies in the webhook URL validation function, where the IP validation is incomplete, potentially allowing external IPs to be accepted, which could lead to unauthorized access or misuse.
The flaw allows an attacker to exploit a SSRF vulnerability in Stirling-PDF's API, potentially leading to unauthorized access to internal resources.
The flaw allows an attacker to traverse directories and potentially execute arbitrary code by manipulating path parameters in Node-RED's local-filesystem library storage module.
The flaw allows an attacker to execute arbitrary code by manipulating file paths in Structured Text (.st) program files, due to lack of proper validation.
The flaw in microtar allows an attacker to overwrite the 100-byte field of a stack-allocated structure via a long entry name, leading to potential buffer overflow and execution of arbitrary code.
The flaw in tinyobjloader-c allows an attacker to overflow a stack buffer by manipulating a .mtl file, leading to potential code execution or data corruption.
The flaw involves an insecure use of strcpy without length checking, leading to potential stack buffer overflow when processing MOCHAD_RFSEC messages in Domoticz.
The flaw allows unauthenticated clients to access the device's general configuration, including network, hardware, and LED setup details, posing a security risk.
The flaw in LINUXTCP port of FreeModbus involves an off-by-one error in a bounds check, leading to potential buffer overflow if exploited.
The IoTSharp BlobStorageController.cs lacks proper authorization, allowing unauthenticated attackers to manipulate storage endpoints, leading to potential data breaches and unauthorized access.
The flaw involves an integer overflow in the parsing of W64 CUE chunk metadata, leading to potential buffer overflows and code execution.
The flaw is an operator-precedence bug in the cv.url validator, allowing any file: URI to pass validation, which can lead to unauthorized access to external components.
The flaw allows memory corruption via uncanceled AIO requests on error, potentially leading to kernel writes into caller-owned buffers.
The vulnerability allows an attacker to inject OS commands through a crafted project name, leading to potential remote code execution.
The flaw in nanoMODBUS allows an out-of-bounds stack read, leading to a potential wild-pointer write. This can be exploited by an attacker to gain unauthorized access or cause system instability.