All CVEs — page 9 of 1220
The complete archive, 25 per page, newest first. 30483 records. Search instead.
The AsiaInfo BSS 9.2.0–9.2.40 fails to properly validate cryptographic signatures on JWTs, allowing attackers to forge valid-looking tokens without knowing the signing key. This enables unauthenticated remote users to impersonate privileged accounts and execute unauthorized administrative actions.
The AsiaInfo BSS 9.2.0–9.2.40 management API endpoint '/bss/sysmgnt/api/' lacks authentication, allowing unauthenticated remote attackers to perform administrative actions such as creating privileged accounts or taking over existing ones. This critical flaw stems from missing access controls (CWE-862) and the absence of authentication checks (CWE-306).
Adobe Connect contains an SQL injection vulnerability (CWE-89) due to improper neutralization of special SQL elements in user-supplied input. A low-privileged attacker can exploit this without user interaction to execute arbitrary code in the context of the current user, with scope changed from original to new context.
Adobe Connect contains a path traversal vulnerability (CWE-22) allowing authenticated low-privilege users to read arbitrary files on the server by manipulating file paths outside the intended directory scope. This is due to insufficient validation of user-supplied path inputs.
A stored XSS vulnerability in Adobe Connect allows low-privileged attackers to inject malicious scripts into form fields, which execute in victims' browsers when they view the compromised page, enabling session hijacking or account takeover with elevated scope.
Adobe Connect contains an SQL injection vulnerability (CWE-89) due to improper neutralization of special characters in SQL commands, allowing unauthenticated remote attackers to execute arbitrary SQL queries without user interaction. This could lead to full data exfiltration, unauthorized modification, or service disruption.
Adobe Connect contains an SQL injection vulnerability (CWE-89) due to improper neutralization of special SQL elements in user-supplied input. A low-privileged attacker can exploit this without user interaction to execute arbitrary code in the context of the current user, with scope changed from original to new context.