All CVEs — page 908 of 912
The complete archive, 25 per page, newest first. 22791 records. Search instead.
The flaw in Node.js HTTP/2 handling can lead to a heap-use-after-free condition when `nghttp2_session_mem_send()` is called re-entrantly while `nghttp2_session_mem_recv()` is executing, which could allow attackers to crash the application or execute arbitrary code.
The vulnerability allows NoSQL injection by passing unvalidated checkpoint identifiers into MongoDB queries, potentially leaking sensitive data across tenants.
The vulnerability allows for command injection through the manipulation of the args.id argument in the remove_rule function of GL.iNet AX1800 up to 4.8.3, enabling remote attackers to execute arbitrary commands.
The flaw is an improper boundary validation vulnerability in the handling of authenticated HTTP request bodies, leading to potential buffer overflow and denial-of-service conditions. This matters because it can cause the web service process to crash upon exploitation.
The flaw allows untrusted input to be interpreted as a raster, potentially leading to file writing or network requests, which could result in remote code execution.
This vulnerability allows a remote attacker to execute arbitrary commands as root by exploiting multiple command injection flaws in the /api/esps request handler, leading to complete control of the affected device.
The flaw allows unauthenticated attackers to read arbitrary files and delete videos, posing a significant security risk.
The flaw allows remote code execution by executing unsandboxed Groovy scripts from database template fields, leading to arbitrary code execution and potential server compromise.
The flaw allows unauthenticated attackers to execute arbitrary code by exploiting an insecure deserialization vulnerability in the check_connection endpoint, leading to remote code execution with application process privileges.
A memory corruption vulnerability exists in Qualcomm's fastboot command handler for audio framework configuration when processing untrusted user input, potentially allowing attackers to execute arbitrary code with high privileges.
This flaw involves memory corruption due to invalid length values in Device Capability Extended attributes within NAN Service Discovery Frames, which could lead to remote code execution.
The flaw allows a transient Denial of Service (DoS) by processing an improperly sized wake time response frame, impacting Qualcomm and related firmware products.
The flaw allows attackers to exploit weak UE configuration checks, potentially leading to unauthorized access or data compromise without proper verification of security capabilities.
The flaw involves memory corruption when processing invalid IOCTL device driver requests, which could lead to arbitrary code execution or system crashes.