All CVEs — page 904 of 912
The complete archive, 25 per page, newest first. 22791 records. Search instead.
MaxSite CMS is vulnerable to PHP object injection, allowing unauthenticated attackers to execute arbitrary code via a malicious serialized PHP object in the maxsite_comuser cookie.
The flaw allows a collaborator with write access to a shared chat folder to delete chats and messages belonging to the folder owner, potentially leading to data loss.
The vulnerability allows a chat participant to craft a regex pattern that can consume significant CPU resources, potentially blocking the event loop and affecting other users.
The flaw allows a malicious chat message to execute arbitrary scripts in the browser of the viewer, potentially leading to session token theft and account compromise.
The flaw allows authenticated non-admin users to access full Python tool source code, potentially exposing sensitive information like API keys and internal URLs.
The flaw allows automation rules to cause availability issues for other users due to synchronous computation on the event loop.
This flaw allows attackers to execute arbitrary code by placing a shared object on target storage, due to incorrect access control in the Executive Services dynamic application start path component of NASA cFS v7.0.1. This is a critical vulnerability that can lead to full system compromise.
The flaw allows an attacker to execute arbitrary commands on the system where the vulnerable Google::Auth module is running, due to the lack of proper input validation and control over the command execution.
The flaw allows server-side request forgery and credential exfiltration due to unvalidated URLs from credentials JSON.
A local attacker can exploit a vulnerability in Vim Project versions up to 9.2.0389 to execute arbitrary code, due to an issue in the vms_fixfilename() function.
A local attacker can execute arbitrary code by exploiting the vms_fixfilename() function in Vim versions up to 9.2.0389, allowing for remote code execution.
The flaw is a stack buffer overflow in OpenSIPS due to improper handling of SIP header names, allowing remote attackers to crash the process or achieve remote code execution.
The vulnerability allows command injection through manipulation of the 'esps.apcm.version' argument in the '/api/esps' endpoint, enabling remote code execution.
The flaw allows command injection through manipulation of the workMode argument in H3C NX15 V100R017's esps.ipv6.wan function, enabling remote code execution.
The vulnerability allows command injection through manipulation of the esps.filter.url argument in the Add function of H3C NX15 V100R017's /api/esps API, enabling remote code execution.
This vulnerability allows unauthenticated attackers to inject arbitrary PHP code into the application configuration file, leading to persistent remote code execution as the web-server process user.
This vulnerability allows unauthenticated attackers to bypass authentication by manipulating the X-Requested-With header, gaining access to admin endpoints and performing actions such as manipulating poll states and vote counts.
The flaw allows any authenticated user to execute scripts in the Open WebUI origin, potentially leading to session hijacking and server-side code execution.