All CVEs — page 895 of 912
The complete archive, 25 per page, newest first. 22791 records. Search instead.
The flaw in nanoMODBUS allows for an out-of-bounds write due to improper validation of the object_length field, which can lead to potential code execution or data corruption.
The flaw allows an attacker to perform an out-of-bounds write, leading to potential data corruption or system instability. This is critical because it can be exploited without user interaction and affects the Modbus server-side handle_read_file_record function.
This flaw involves a use-after-free condition in the RDMA/rxe module of the Linux kernel, leading to potential kernel crashes or page use-after-free vulnerabilities.
The flaw allows unauthenticated clients to read any file accessible by the backend process due to improper URI handling and lack of proper token validation in non-Electron deployments.
The flaw allows remote URLs to be included in Facelet processing, potentially exposing sensitive files. This matters because it can lead to unauthorized access to critical server files.
The flaw allows admin users to upload arbitrary files without validation, posing a significant security risk.
The flaw allows unauthorized users to perform database operations such as adding, editing, and deleting records without proper authentication, posing a significant security risk.
The flaw allows an attacker to bypass authentication by directly manipulating the SQL query through unescaped POST parameters, leading to unauthorized access.
The flaw allows SQL injection by improperly sanitizing user input and directly concatenating it into a SQL query.
The flaw lies in the backmeup npm package, which directly concatenates user-provided values into shell commands, leading to potential command injection. This is significant because it allows an attacker to execute arbitrary commands, compromising the system.
The flaw allows any authenticated user to manipulate notes from another company due to missing company-ownership verification, posing a significant security risk.
The flaw allows unauthorized access to sensitive API endpoints by enumerating card_id values, compromising user data security.
The flaw allows untrusted user input to be directly rendered in email templates, leading to potential template injection attacks.
The flaw lies in DjangoCRM hardcoding the Django SECRET_KEY in the settings.py file, allowing anyone to read the public repository to forge session cookies, CSRF tokens, and password reset tokens, leading to full account takeover.
The flaw allows an unauthenticated attacker to bypass authentication and potentially extract database data via SQL injection, posing a critical security risk.
The flaw lies in the manual reversal of HTML entity encoding after purification with HTMLPurifier, potentially allowing for injection of malicious scripts.
The flaw allows authenticated users to execute arbitrary Lua scripts, leading to remote code execution (RCE) and potential data exfiltration or system compromise.
The flaw allows unauthorized access to document downloads by merely providing a non-empty query parameter, leading to potential data exposure.