All CVEs — page 923 of 938
The complete archive, 25 per page, newest first. 23442 records. Search instead.
The flaw allows an attacker to perform unlimited password-guessing attempts against any account, including administrators, due to the absence of rate-limiting or account lockout mechanisms when the captcha is disabled, which is the default configuration.
The flaw allows an attacker to inject arbitrary API endpoints, potentially leading to unauthorized access or data exfiltration.
The flaw allows unauthenticated access to sensitive resources via URL-encoded paths, potentially enabling unauthorized data exposure.
The flaw allows direct SQL injection due to lack of parameterization and escaping, and includes hardcoded admin credentials, enabling full authentication bypass.
The flaw lies in the CheckToken function, which does not re-fetch the account from the database even if the JWT's HMAC signature is valid. This can lead to unauthorized access to user accounts.
The flaw allows for potential out-of-bounds memory access due to improper validation of offset parameters in the crop function, which could lead to arbitrary code execution if exploited.
The flaw allows a negative ratio to cause image processing functions to fail, potentially crashing the application due to invalid width values.
The flaw allows remote code execution by manipulating the ratio parameter in imagecli's pipeline operation without proper validation, leading to potential crashes or arbitrary code execution.
The flaw in Pluck CMS's admin panel allows attackers to perform cross-site request forgery (CSRF) attacks by manipulating the Referer header, leading to potential unauthorized actions.
The flaw allows unauthenticated attackers to access sensitive information such as API keys and task parameters through the `getCurrentTaskResults()` method in the AIWU plugin for WordPress.
The flaw allows unauthenticated attackers to modify or delete Stripe payment credentials, potentially redirecting payments to attacker-controlled accounts or disabling the Stripe integration entirely.
The LightSync Pro plugin for WordPress allows attackers to upload arbitrary files due to missing file type validation, posing a risk of remote code execution for users with Author-level access or higher.
The flaw allows unauthenticated attackers to modify and access data through missing capability checks in the Material Dashboard plugin for WordPress.
The flaw allows arbitrary function execution via an unfiltered user input parameter, enabling authenticated attackers with Administrator-level access to run any PHP code.
This vulnerability in the Linux kernel allows a race condition where a per-socket policy change can race with a send operation, leading to a double-free of the socket's dst cache, potentially causing a kernel crash or denial of service.
The vulnerability in the Linux kernel's xfrm6 module allows for a double netdev_put underflow, potentially leading to a denial of service or other kernel issues.
This vulnerability allows a remote client to perform a slab-out-of-bounds read by crafting a compound SMB2 request, potentially leading to information disclosure.