All CVEs — page 943 of 961
The complete archive, 25 per page, newest first. 24011 records. Search instead.
The flaw lies in the safeDialContext function of Memos' webhook dispatch, which fails to use validated IP addresses for network connections, potentially allowing attackers to exploit DNS resolution to execute unauthorized actions.
The flaw lies in the webhook URL validation function, where the IP validation is incomplete, potentially allowing external IPs to be accepted, which could lead to unauthorized access or misuse.
The flaw allows an attacker to exploit a SSRF vulnerability in Stirling-PDF's API, potentially leading to unauthorized access to internal resources.
The flaw allows an attacker to traverse directories and potentially execute arbitrary code by manipulating path parameters in Node-RED's local-filesystem library storage module.
The flaw allows an attacker to execute arbitrary code by manipulating file paths in Structured Text (.st) program files, due to lack of proper validation.
The flaw in microtar allows an attacker to overwrite the 100-byte field of a stack-allocated structure via a long entry name, leading to potential buffer overflow and execution of arbitrary code.
The flaw in tinyobjloader-c allows an attacker to overflow a stack buffer by manipulating a .mtl file, leading to potential code execution or data corruption.
The flaw involves an insecure use of strcpy without length checking, leading to potential stack buffer overflow when processing MOCHAD_RFSEC messages in Domoticz.
The flaw allows unauthenticated clients to access the device's general configuration, including network, hardware, and LED setup details, posing a security risk.
The flaw in LINUXTCP port of FreeModbus involves an off-by-one error in a bounds check, leading to potential buffer overflow if exploited.
The IoTSharp BlobStorageController.cs lacks proper authorization, allowing unauthenticated attackers to manipulate storage endpoints, leading to potential data breaches and unauthorized access.
The flaw involves an integer overflow in the parsing of W64 CUE chunk metadata, leading to potential buffer overflows and code execution.
The flaw is an operator-precedence bug in the cv.url validator, allowing any file: URI to pass validation, which can lead to unauthorized access to external components.
The flaw allows memory corruption via uncanceled AIO requests on error, potentially leading to kernel writes into caller-owned buffers.
The vulnerability allows an attacker to inject OS commands through a crafted project name, leading to potential remote code execution.
The flaw in nanoMODBUS allows an out-of-bounds stack read, leading to a potential wild-pointer write. This can be exploited by an attacker to gain unauthorized access or cause system instability.
The flaw in nanoMODBUS allows for an out-of-bounds write due to improper validation of the object_length field, which can lead to potential code execution or data corruption.
The flaw allows an attacker to perform an out-of-bounds write, leading to potential data corruption or system instability. This is critical because it can be exploited without user interaction and affects the Modbus server-side handle_read_file_record function.
This flaw involves a use-after-free condition in the RDMA/rxe module of the Linux kernel, leading to potential kernel crashes or page use-after-free vulnerabilities.
The flaw allows unauthenticated clients to read any file accessible by the backend process due to improper URI handling and lack of proper token validation in non-Electron deployments.
The flaw allows remote URLs to be included in Facelet processing, potentially exposing sensitive files. This matters because it can lead to unauthorized access to critical server files.