97,131 results · Clear filters · Feed
-
High 7.5
Mistune before 3.3.0 Path Traversal and XSS via Include Directive
Mistune before 3.3.0 contains a path traversal vulnerability in the Include directive that allows attackers to read arbitrary files by supplying ../ sequences in include paths. Attackers can also inject HTML through unescaped error messages and included file …
-
High 8.6
Missing authorization in the Prospero Flow CRM user API allows a basic role user to read and delete other accounts
Missing Authorization (CWE-862) in the user API of Roskus Prospero Flow CRM from 2.0.0 before 5.26.0 allows a user with a basic role to read the accounts of other users of its own company, including accounts with higher privileges, and, in versions from 3.5.0…
-
High 8.6
Mistune before 3.3.0 Path Traversal via include Directive
Mistune before 3.3.0 contains a path traversal vulnerability in the RST include directive that allows attackers to read arbitrary files by supplying relative or absolute paths. Attackers can submit markdown containing include directives referencing ../ sequen…
-
High 7.5
Mistune before 3.3.0 Quadratic-Time DoS via Unmatched Brackets in Inline Parser
Mistune before 3.3.0 contains an algorithmic complexity vulnerability in the inline link parser that allows unauthenticated attackers to exhaust CPU by submitting long runs of unmatched '[' characters. Attackers can send small markdown payloads that trigger O…
-
High 7.5
Mistune 3.0.0 before 3.3.0 Denial of Service via Nested Bracket Parsing
Mistune from 3.0.0 before 3.3.0 contains an algorithmic complexity denial of service vulnerability in the parse_link_text function in src/mistune/helpers.py. Attackers can submit markdown with deeply nested square brackets triggering quadratic parsing time, e…
-
High 7.5
Mistune before 3.3.0 Quadratic-Time DoS via parse_link_text
Mistune from 3.0.0 before 3.3.0 contains an algorithmic complexity vulnerability in the inline link parser's parse_link_text function that allows unauthenticated attackers to exhaust CPU with unbalanced brackets. Attackers can submit Markdown containing many …
-
High 7.5
Mistune before 3.3.0 Quadratic Denial of Service via parse_link_text
Mistune before 3.3.0 contains an inefficient algorithmic complexity vulnerability in parse_link_text that allows remote attackers to cause denial of service through unbalanced square brackets. Attackers can submit markdown containing long runs of unmatched br…
-
High 7.0
Unauthenticated Buffer Overflow Vulnerability leads to Denial-of-Service in AOS-8 Command Line Interface
An unauthenticated buffer overflow vulnerability exists in the command line interface of AOS-8. Successful exploitation could allow an unauthenticated remote attacker to disrupt the availability of the affected interface, along with limited access to or modif…
-
High 7.1
Unauthenticated Adjacent Sensitive Information Disclosure and Denial-of-Service in AOS-8 via the PAPI Protocol
A sensitive information disclosure vulnerability in the PAPI protocol of AOS-8 could allow an unauthenticated adjacent attacker to access limited information handled by the affected service. Successful exploitation could allow an attacker to view some informa…
-
High 7.1
Authentication Bypass Leading to Remote Code Execution in AOS-10 Web-Based Management Interface
An authentication bypass vulnerability in the web-based management interface of AOS-10 could allow an unauthenticated adjacent attacker to circumvent existing authentication controls and run arbitrary commands on the underlying host if certain preconditions o…
-
High 7.1
Unauthenticated Adjacent Buffer Overflow Vulnerability leads to Denial-of-Service in AOS-10 or AOS-8
An unauthenticated buffer overflow vulnerability exists in the underlying operating system of AOS-10 or AOS-8 and could allow an unauthenticated adjacent attacker to conduct a denial of service attack. Successful exploitation could allow an attacker to disrup…
-
High 7.2
Authenticated Command Injection Vulnerabilities in AOS-10
Command injection vulnerabilities exist in the affected interface of AOS-10 that could allow an authenticated remote attacker with high privileges to perform command injection. Successful exploitation could allow an attacker to execute arbitrary commands as a…
-
High 7.2
Authenticated File Write leads to Command Injection Vulnerabilities in AOS-10
Command injection vulnerabilities exist in the affected interface of AOS-10 that could allow an authenticated remote attacker with high privileges to perform command injection. Successful exploitation could allow an attacker to execute arbitrary commands as a…
-
High 7.2
Authenticated Buffer Overflow Vulnerability leads to Remote Code Execution in AOS-8
A buffer overflow vulnerability in the PAPI protocol of AOS-8 could allow an authenticated remote attacker with high privileges to achieve remote code execution. Successful exploitation could allow an attacker to execute arbitrary code as a privileged user on…
-
High 7.2
Authenticated Command Injection Vulnerabilities in AOS-8
Command injection vulnerabilities in the affected interface of AOS-8 could allow an authenticated remote attacker with high privileges to perform command injection. Successful exploitation could allow an attacker to execute commands with the privileges of the…
-
High 7.2
Authenticated Command Injection Vulnerabilities in AOS-8
Command injection vulnerabilities in the affected interface of AOS-8 could allow an authenticated remote attacker with high privileges to perform command injection. Successful exploitation could allow an attacker to execute commands with the privileges of the…
-
High 7.2
Authenticated Remote Code Execution allows Unauthorized System Control in Wireless Network Management Interface
A vulnerability in the web-based management interface of wireless network management systems could allow an authenticated remote attacker to execute remote code. Successful exploitation could enable an attacker to execute arbitrary commands on the underlying …
-
High 7.2
Improper Sanitization leads to Command Injection in AOS-8 Web Interface
A vulnerability in the CLI command handling of the AOS-8 web interface could allow an authenticated remote attacker to execute arbitrary commands on the underlying operating system. Successful exploitation could allow an attacker to run unauthorized commands …
-
High 7.5
Unauthenticated Memory Corruption Vulnerability leads to Denial-of-Service in AOS-8
An unauthenticated memory corruption vulnerability exists in a service accessed via the PAPI protocol in AOS-8 that could allow an unauthenticated remote attacker to conduct a denial of service attack. Successful exploitation could allow an attacker to disrup…
-
High 7.5
Unauthenticated Remote Denial-of-Service (DoS) Vulnerabilities in AOS-10
Vulnerabilities in the affected interface of AOS-10 could allow an unauthenticated remote attacker to conduct a denial of service attack. Successful exploitation could allow an attacker to disrupt the availability of the affected interface.
-
High 7.5
Unauthenticated Denial-of-Service (DoS) Vulnerability in the PAPI Protocol of AOS-8
An unauthenticated Denial-of-Service (DoS) vulnerability exists in the PAPI protocol of AOS-8. Successful exploitation of this vulnerability results in the ability to disrupt the availability of the affected interface.
-
High 7.5
Unauthenticated Memory Corruption Vulnerabilities lead to Denial-of-Service in AOS-10
Memory corruption vulnerabilities in AOS-10 could allow an unauthenticated remote attacker to conduct a denial of service attack. Successful exploitation could allow an attacker to disrupt the availability of the affected service.
-
High 7.8
Authenticated Local Memory Corruption Vulnerability leads to Arbitrary Code Execution in AOS-8
A memory corruption vulnerability exists in AOS-8 that could allow an authenticated local attacker to execute arbitrary code. Successful exploitation could allow the attacker to execute arbitrary code as a privileged user on the underlying operating system.
-
High 8.1
Unauthenticated Buffer Overflow Vulnerability leads to Remote Code Execution in AOS-8
A buffer overflow vulnerability exists in the command line interface of AOS-8 that could allow an unauthenticated remote attacker to run arbitrary commands on the underlying host if certain preconditions outside of the attacker's control are met. Successful e…
-
High 8.1
Unauthenticated Command Injection Vulnerabilities in AOS-8 Accessed by the PAPI Protocol
There are command injection vulnerabilities in AOS-8 that could lead to unauthenticated remote code execution by sending specially crafted PAPI packets. Successful exploitation of this vulnerability results in the ability to execute arbitrary code as a privil…
-
High 8.1
Multiple Unauthenticated Buffer Overflow vulnerabilities in AOS-8 Web Interface result in Remote Code Execution
Vulnerabilities in multiple web interface endpoints of AOS-8 devices could allow an unauthenticated remote attacker to trigger a buffer overflow by using specially crafted requests. Successful exploitation could allow an attacker to execute arbitrary commands…
-
High 8.1
Unauthenticated Buffer Overflow allows Remote Code Execution in web interface
A vulnerability in a certain web interface endpoint of AOS-8 devices could allow an unauthenticated remote attacker to trigger a buffer overflow. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system,…
-
High 8.1
Authentication Bypass in Web Interface of AOS-8 allows Remote Command Execution (RCE)
A vulnerability in the web interface of AOS-8 could allow an unauthenticated remote attacker to achieve remote code execution. Successful exploitation could lead to complete device control, enabling interception of network traffic and potential compromise of …
-
High 8.2
Unauthenticated Buffer Overflow Vulnerability leads to Denial-of-Service in AOS-8
An unauthenticated buffer overflow vulnerability exists in the PAPI protocol of AOS-8. Successful exploitation could allow an unauthenticated remote attacker to disrupt the availability of the affected service on the controller, with a limited impact to its i…
-
High 8.2
Unauthenticated File Write Vulnerability leads to Denial-of-Service in AOS-8
An unauthenticated file write vulnerability exists in the PAPI protocol in AOS-8. Successful exploitation could allow an unauthenticated remote attacker to make limited modifications to files on the affected system and to disrupt the availability of the affec…
-
High 8.2
Authentication Bypass leads to Sensitive Information Disclosure in AOS-8
A vulnerability in the web-based management interface of AOS-8 could allow an unauthenticated adjacent attacker to bypass existing authentication controls and access sensitive information. Successful exploitation could allow an attacker to gain access to some…
-
High 8.3
Unauthenticated Adjacent Buffer Overflow Vulnerability in the PAPI Protocol leads to Sensitive Information Disclosure in AOS-10
A buffer overflow vulnerability in the PAPI protocol of HPE Networking AOS-10 could allow an unauthenticated adjacent attacker to access sensitive information. Successful exploitation could allow an attacker to retrieve information which could be used to pote…
-
High 8.3
Unauthenticated Adjacent Command Injection Vulnerability in the PAPI Protocol of AOS-10
There is a command injection vulnerability in the PAPI protocol of AOS-10 that could lead to unauthenticated remote code execution by an adjacent attacker sending specially crafted packets. Successful exploitation of this vulnerability could allow an attacker…
-
High 8.5
Authentication Bypass Leading to Remote Code Execution in AOS-8
An authentication bypass vulnerability in the underlying operating system of AOS-8 could allow an unauthenticated remote attacker to circumvent existing authentication controls. Successful exploitation could allow an attacker to execute arbitrary code as a pr…
-
High 8.7
Authenticated Server-Side Request Forgery leads to Remote Code Execution in AOS-8
A vulnerability in the command line interface of AOS-8 could allow an authenticated remote attacker with high privileges to conduct a server-side request forgery (SSRF) attack. Successful exploitation could allow an attacker to execute arbitrary commands on t…
-
High 8.8
Unauthenticated Adjacent Memory Corruption Vulnerabilities lead to Remote Code Execution in AOS-10
Memory corruption vulnerabilities in the affected interface of AOS-10 could lead to remote code execution by an unauthenticated adjacent attacker. Successful exploitation could allow an attacker to execute arbitrary code as a privileged user on the underlying…
-
High 8.8
Unauthenticated Adjacent Command Injection Vulnerability in the AOS-8 Command Line Interface Accessed by the PAPI Protocol
A command injection vulnerability in the AOS-8 command line interface accessed by the PAPI protocol could lead to unauthenticated remote code execution by an adjacent attacker sending specially crafted PAPI packets destined to the PAPI UDP port 8211. Successf…
-
High 8.8
Unauthenticated Adjacent Remote Code Execution Vulnerability in AOS-10
A remote code execution vulnerability in the underlying operating system of AOS-10 could allow an unauthenticated adjacent attacker to execute arbitrary code on an affected device. Successful exploitation could allow an attacker to execute arbitrary commands …
-
High 7.8
OS command injection in the Terraform hook in AWS SAM CLI
OS command injection in the Terraform hook in AWS SAM CLI before 1.166.2 might allow an actor who can influence the Terraform configuration or plan file consumed by a build to execute arbitrary commands as the build user on the host running the build via a cr…
-
High 7.5
MessagePack: Unbounded memory leak in msgpack C extension on strict_map_key validation failure
MessagePack is the serializer implementation for Python msgpack.org. Prior to 1.2.3, the msgpack-python C extension (msgpack._cmsgpack) leaks a decoded map value when deserialization rejects a key with strict_map_key=True (the default). Repeated malformed inp…